Some secure boot machines cannot seem to boot Windows from grub.
A workaround is to provide a different set of EFI files for each type
of boot, putting the second set for Ubuntu on a USB stick, and
leaving the EFI files on the hard disk for Windows.
You have a working Ubuntu set of EFI files already on the
hard disk, so take a (small) USB stick (empty, as you will lose all data
on it), put a GPT partition table on it, and make a 250M partition for
the EFI files. Copy the hard disk's EFI files to the stick. They will
appear in the /boot/efi directory, under the directory EFI. Take the EFI
directory and all its contents, and put it on the USB partition.
I'd suggest editing the stick version of EFI/ubuntu/grub.cfg to change
the name of the menu item "Ubuntu" to "Ubuntu on USB" or something to
make it obvious which set of files you are booting with. Now
try booting from the USB, and see if you get the altered menu item,
and that it works. When the USB boot is working, you may simply go
to /boot/efi/EFI/Boot, which should be the hard disk's EFI partition, and
it should contain copies (possibly with different names) of the Ubuntu
versions of the boot files, which should also be in /boot/efi/EFI/ubuntu.
Use md5sum to confirm that you have copies of all files which are in
/boot/efi/EFI/Boot, because you are going to delete them! Copy and
rename the file /boot/efi/EFI/Microsoft/bootxmgfw.efi to /boot/efi/EFI/Boot/bootx64.efi
and you should be able to boot windows from the hard disk again -- remove
the stick and try the Windows boot.
When you update the kernel, and get a new grub.cfg generated on the hard
disk (unused, since the hard disk boots only Windows), you will have to
copy it yourself to the USB stick's EFI/ubuntu/grub.cfg.
Hopefully, at some point, the issue of grub not booting Windows on your
machine will be fixed, and you can simply replace the hard disk's EFI/Boot
file with the ones on the stick's EFI/Boot.
Just make sure you have copies of anything you delete, so you can replace them
if necessary. This technique worked for me on a Toshiba.