I know zfsbootmenu seems the new hotness, and I keep it around myself for recovery reasons, but I have had issues with the kexec logic on some hardware, and I especially think it needs a better SecureBoot strategy, if any.
I personally prefer UKI images that boot directly from UEFI firmware using the EFI partition for the time being. I have this set up on an Ubuntu desktop machine, with the benefit that Ubuntu still uses the classic kernel + initrd logic that I can easily revert back to if needed. I just bundle them in a UKI image and sign them, all with sbctl (which I also use to sign ZBM EFI binaries by the way, not solving the SecureBoot issues I have had). Just add 2 commands to the regular update logic you have.
It has been exceptionally reliable, and I have since then upgraded my natived encrypted rootpool to include all the new stuff without any boot issues. Grub is installed on the system to avoid dependency issues in the future, but grub-install was never executed, and would not interfere with the UEFI boot entries for the UKI anyway.