However although I do see wire format documentation on Google's site, I don't see an actual BNF grammar anywhere and that makes me nervous.

So what? The .proto file may not be a BNF grammar but it tells an application what to expect and presumably the generated code can check for validity. e.g.

  message Person {
    required int32 id = 1;
    required string name = 2;
    optional string email = 3;
  }

Is that really any different from

  <Person> ::= <id> <name> | <id> <name> <email>
  ...

?