splstartups and startup.s are just turds left over from development. They aren't used in the actual code.

check out the Makefile and there you will find the real files actually used by the chumby bootloader.

boot.S, bl.c, 2bl.c are critical main-path code pieces. The uart.c, lcdc.c, touchpanel.c, setupKernel.c, mx2_2bl_readwrite.c are libraries that are used by this bootloader.

Chapters 23, 9, and 10 of the i.MX21 reference manual from Freescale will explain what the processor does with the code. Basically, it automatically reads page0 out of flash, sticks it into a buffer located at 0xDF003000, and executes it. That's boot.S. boot.S sets up the basic hardware registers and sucks in bl.c, which does some more initialization and copies the first block (guaranteed no bad blocks) into SDRAM and then jumps to that. The first block contains 2bl.c, which contains the bad-block handling code and so forth, as well as all the libraries to setup LCD, touchscreen, render images, interact over the UART, etc. etc--all the stuff you "see" at boottime. 2bl.c generally just checks touchscreen state, checks some flags stored in FLASH, and based on a combination of those selects which kernel to load into memory and run.

The JTAG signals available on  expansion connector are crypto-processor signals. you can access The iMX21 JTAG signals  via test points and two resistor pads, but is not easy to attach an external connector. You can boot the iMX21 in bootstrap mode, just follow the cpu schematics note.
Then you can use tha HAB toolkit for download applications to internal RAM.

I don't know how the  chumby team write the NAND flash, but i think that they use an external flash burner and mount the programmed flash in production.