I don't know what the magic is behind the YAST box "Protect Entry Modification Only".

I paid money for a SLED subscription with standard support. If i have any technical issue, i will ask the SUSE support/hotline for a solution. I had the same grub2@SLED12 issue. I opened a "Service Request" and the SUSE support/hotline solved this issue in SLED12SP1.

# rpm -q --changelog grub2 |more

* Die Jun 16 2015 mchang@suse.com
- Allow to execute menuentry unrestricted as default (fate#318574)
  * added grub2-menu-unrestricted.patch
I recommend to leave the grub2 configuration files in /etc/grub.d/ untouched:

# rpm -V grub2 |grep -i /etc/grub.d
=> empty output

and configure grub2 with YAST.