Well, i already have more info, and a repro for the 545(/544)MHz bug.
It seems to be due to a race condition between consecutive calls of \_SB_.PCI0.GPP0.M241(1), the matching EC PMF handler, and \_SB_.PCI0.GPP0.M241(0).
The easiest way to trigger it is:
# echo '\_SB_.PCI0.GPP0.M241 0x01' >/proc/acpi/call; cat /proc/acpi/call; sleep 0.1; echo '\_SB_.PCI0.GPP0.M241 0x00' >/proc/acpi/call; cat /proc/acpi/call
It still is probabilistic, so it won’t always happen (and also sometimes it locks the freq to 1400 MHz instead), but it happens roughly 60% of the time, which is a great step towards identifying the underlying cause.