I'm not an Android expert but here's what I've learned so far:
Since Android is based on Linux, once the kernel is loaded it executes /system/core/init, which launches the processes listed in init.rc. One such process is app_process, which is the Zygote Java VM. The process that handles launching userspace apps appears to be /system/bin/runtime. You would need root to edit init.rc.
As far as user apps launching at boot, I'm still doing some research, but it appears that an app can register a class to receive the "BOOT_COMPLETED" action. This action is broadcast after the Java VM is initialized and the system is ready to execute user code. When the receiver class for the app receives this action it launches itself. I think you can disable this behavior by editing the AndroidManifest.xml file and removing the appropriate <intent-filter>. Here's an example:
http://www.anddev.org/launch_activit...rtup-t428.html
I'm not sure if this works or if there's a better way. I'm still really new to Android. I don't even have a terminal on my eDGe yet or downloaded the SDK.
Here's some helpful links that explain this:
http://www.anddev.org/viewtopic.php?p=33996
http://benno.id.au/blog/2007/11/13/a...under-the-hood
http://benno.id.au/blog/2007/11/18/a...mework-startup
http://blog.vlad1.com/2009/11/19/and...probably-many/
http://blog.chinaunix.net/u2/85805/showart_1421736.html