Note: It's easier to create a rEFInd USB drive in advance, obviously, but can be improvised after the excrement has hit the fan. The drive can be setup from a live session, virtual machine or any almost computer running Linux. Doesn't matter which Linux or desktop. All it does is provide a platform to format an EFI partition, download a zip file, and run an installer script directed at an external drive.
How it works. What makes rEFInd useful for emergency boot is that the Linux kernel is bootable in its own right, without need for a separate boot loader. This means rEFInd on USB drive can boot kernel images of an installed system, even if Grub and/or NVRAM have been damaged or misconfigured. It also can boot Windows (using its boot loader) even if Grub is damaged. Someone taught me this trick early in my Linux journey and I've had a rEFInd USB drive sitting next to my computer ever since. By the way, once booted, you can remove the rEFInd drive, freeing up the port.
Select target. rEFInd needs to be installed to an EFI partition. Simplest solution is to dig out an old 2.0 flash drive, put rEFInd on it and don't worry about the remaining space. Or you can create two (or more) partitions, one for rEFInd and another for something else (e.g., data files). Or you can clear a little space on a backup drive and put the EFI partition there. My personal preference is a full install USB drive with rEFInd instead of Grub.
EFI Partition. Can be very small; the rEFInd files are only about 2 MB. Anything less than 100 MB sometimes draws squawks from partitioning tools, though, so that's what I use. Partition needs to be FAT format, with boot/esp flags. For GUI, use GParted or Gnome Disks. For CLI, use fdisk or gdisk. If you're new to partitioning, plenty of tutorials are available on the internet.
Download files. rEFInd is available in several formats. For this tutorial, you want the binary zip file, download links here. Files are hosted at SourceForge; current version is 0.14.2, uploaded Apr'24. Extract zip file. Can use the Downloads folder or move first to another. Downloads is fine if planning to delete folder after creating the USB drive (always can download again, if needed).
Install. The zip file includes a script for installing rEFInd to the EFI partition. Open Terminal in the extracted folder. For example, double-click in file manager, then right-click and select Open in Terminal; or open Terminal then cd to the appropriate folder. Run command in this form (notice dot): ./refind-install --usedefault /dev/sdxn --alldrivers , where sdxn = target EFI partition (e.g., sdb1); sudo not needed, but will be prompted for password.
Ventoy. If you use Ventoy, there's an even simpler option. On download page (link above), there's also a CD-R image file. Again, it's a zip file. Once extracted, there will be a .img file in the folder. Copy this to your Ventoy images folder. Ventoy will boot directly from the rEFInd img file, same as if it were an ISO.
How to Use. Attach USB drive, power up and select USB drive from firmware boot menu. If secure boot is enabled, you'll need to disable it,* but can re-enable later (after having fixed whatever is causing you to use rEFInd in the first place). rEFInd scans the computer for bootable objects, including boot loaders and Linux kernel images. Will present a horizontal row of icons with available options, first boot loaders, then kernel images. (Second row has tools.) Arrow-key to desired option, then Enter to select. To access backup kernels, similar to advanced boot options in Grub, press F2, Insert or Tab; use arrow keys to select desired kernel, then Enter to boot.
* Well, there is a way to leave secure boot enabled, provided you do the work ahead of time. You would copy rEFInd's secure boot certificate (and those of all installed systems) to the internal drive's EFI partition, then register the certificates with MOK. Only worth the trouble, though, if planning to use the USB drive for everyday boot, in which event might as well install rEFInd to the computer (see next paragraph). In any event, there's no way to certify the USB drive itself, so it will be secure boot qualified on all systems.
Replacing Grub. If you like the USB drive and decide to replace Grub on the installed system with rEFInd, I recommend the repo method (installs packages which, in turn, install rEFInd to the internal drives's EFI partition). As mentioned, unlike a USB drive, it's possible to endorse installed rEFInd so it's secure boot compatible. There are many configuration options, not particularly useful for a USB drive but handy if using rEFInd as main boot manager. Also, you will want to freeze Grub updates (sudo apt-mark hold) or even remove the Grub packages altogether. rEFInd's website (link above) discusses in detail all these issues and more.
