Obligatory XKCD:
With that out of the way...
The basics of the boot process
First, you need to know how a bootloader works. When the system first starts up and the BIOS is in charge, it initializes all the devices necessary for boot. It then reads the CMOS to find out the correct device to boot from. It opens the first device, and reads the first 512 byte sector (where the MBR should be installed) into memory. Specifically, it transfers the first sector to physical address 0x7c00. If the last two bytes of the sector are 0x55aa, it considers it a valid bootsector, and executes it. At this point, the BIOS is out of the picture, and the MBR is executing. The MBR is far too small to boot most systems, so instead it boots the second stage of the bootloader. All it has to do is be able to locate and execute some data on the hard drive containing the rest of the bootloader. In this case, the core GRUB modules. At this point, GRUB is fully functional and does all its magic to load your kernel and start the operating system boot process. Now, how can malware hijack this?
Hijacking the process
If malware wants to modify your boot process to randomly make you boot with malicious code in play, it can do one of a few things. In order of increasing levels of sophistication and stealth:
It can modify the second stage bootloader or its configuration directly, so when it is executed, it changes its behavior at random, performing malicious actions during some boots.
It can modify the MBR at the first sector on the bootable drive to, at random, choose to load a different second stage bootloader. The different second stage would inject malicious code.
It could modify your BIOS so it loads a different, malicious MBR for some boots. This is more difficult to pull off, but it is possible. BIOS infections are quite rare.
It could modify the hard drive firmware to return malicious data in the first sector randomly. This would require a very high level of expertise, and is exceedingly rare (virtually unheard of).
The displayed symptoms
But here's the important question... Are the symptoms you are describing indicative of any of the above scenarios? Let's look at the symptoms as you described them, one by one:
Your bootloader counted down from 25 seconds, despite you having set the timeout lower.
Your Ubuntu installation occasionally has a blank screen after you log in, or randomly reboots.
It rebooted itself without you commanding it to do so when it loaded GRUB.
Are these symptoms of a bootkit? No. The first issue is most likely a configuration issue. Every update, your Ubuntu installation updates the GRUB configuration file. The configuration file is very complex and has a large number of conditional statements. It would not be surprising if your settings are occasionally overwritten. The second issue just sounds like a bug in Ubuntu. Perhaps a driver for your hardware is buggy. I had an old Ubuntu system that did something similar. An update fixed it. Your third issue sounds like a bug in GRUB, or perhaps a hardware fault. All you are experiencing is the bugginess of software. As bugs are still annoying, you could try reinstalling GRUB, or resetting the configuration. Perhaps look online to see if there are any known errata for your software. Check your system logs to see if it is reporting an application crashing that may lead to the blank screen. And, of course, make sure you are up to date, so you get all the latest bug fixes for your setup.
Malware wants to be stealthy. It doesn't want its presence to be found out. Malware that is good enough to hijack your boot process will be very stealthy, and won't give away its existence through something as tantalizingly simple as a spontaneous crash. So no, this is not malware.
