There are some android devices (e.g. the Motorola Defy) with locked bootloaders. You can gain root rights on them, and you can even load kernel modules, but it’s not possible to change the kernel that will be loaded initially. So, my question is:
Would it be possible to write a kernel module that loads another kernel into RAM, disables all interrupts, disables the MMU and then jumps into the new kernel image? Could that work, or would some already-initialized devices mess up everything?
The generic mechanism for doing this in linux is kexec
Looks like someone has made what you seek work for at least once motorola phone:
http://www.xda-developers.com/android/kexec-bootloader-bypass-released-for-motorola-droid-razr/