It seems that unsigned kernels are left in the /boot directory (not used it seems) which prevents the grub update mechanism to happen correctly. So I think the "design" is wrong and that unsigned kernel in SB mode should just be ignored and shouldn't prevent the postinstall to proceed.
I had the same issue whn upgrading from 17.10 to 18.04 and used the following workaround:
cd /boot 4.10.0- 40-generic vmlinuz- 4.10.0- 42-generic vmlinuz- 4.13.0- 46-generic unsigned/
mkdir unsigned
mv vmlinuz-
apt-get upgrade
and voila problem solved :-)
It seems that unsigned kernels are left in the /boot directory (not used it seems) which prevents the grub update mechanism to happen correctly. So I think the "design" is wrong and that unsigned kernel in SB mode should just be ignored and shouldn't prevent the postinstall to proceed.
Just my 0.02€ and YMMV of course