So, I finally had time to do something with this again.
For a minimal booklet it's actually quite simple. You just need to create a class that extends AbstractBooklet and adding Main-Class: your.package.path.and.BookletClass to META-INF/MANIFEST.MF and that gives you a simple empty window when started.
I hijacked the booklet com.lab126.booklet.testbooklet that should be contained in /opt/amazon/ebook/booklet/testBook.jar but this jar is missing from a non-debug KT. So I didn't even have to overwrite any original files. I used a symlink for testBook.jar, so I didn't had to always do a mntroot although I still had to restart cvm for every update.
Code:
mntroot rw
ln -s /mnt/us/testBook.jar /opt/amazon/ebook/booklet/testBook.jar
mntroot ro
lipc-set-prop com.lab126.appmgrd start app://com.lab126.booklet.testbooklet
There are many methods that you can implement, but so far I've only seen calls to the constructor and create(BookletContext bookletContext) when starting up for the first time, calls to start(URI contentURI) for every start and stop() when pressing the home button.
Here's a link to the class' source code. I'll also attach the jar.
https://gist.github.com/3762793
Wiring that booklet up to the store button is easy enough after this. Just changing in /usr/share/webkit-1.0/pillow/javascripts/search_bar.js the STORE_ID constant to app://com.lab126.booklet.testbooklet and voilą.
Now I only need to extend that booklet to launch HackedUpReader. Should not be too hard.