Given the assumptions, an attacker would have to pick a starting character, generate the 10 character password according to the process described, try it on the site. If it fails, repeat. After the 3rd attempt they would be locked out.
If we assume that on account creation you pick a good random starting place (in other words, every starting position is equally likely), then there are $20^2=400$20^2=400 possible starting positions. The probability of any one the attacker chooses being right is $\frac{1}{1/400}$, so the probability that they get it right in three guesses is $\frac{3}{3/400}$. A pretty low probability that you are likely willing to accept.
Where you might run into problems is if you start packing lots of sites into the same grid. Say you use the same grid for 50 sites. The attacker's probability of success is now $(50)\frac{3}{400}=0*3/400=0.375$375.
The good news is you can at least quantify the success chances of your attacker. If you have lots of accounts (and try to pack them all into one grid) you might be in trouble.