My project is not any more on shaky ground than Google's own business. Search engines or any service that lets users upload or link content is prone to cease and desist letters. Only very recently there was a post here on HN where someone complained that 6 tweets were uploaded to a competitor's site by a user.
And then there's Google's user authentication service, which is very convenient. I can't think of a way to migrate that one without asking all my users to create new accounts and provide their google login password so I can check whether they are the legitimate owner of that account.
As for user auth, I'd suggest setting up a table that stores the user's email address and a random hash, so if google auth stops working they can just "reset their password" and you can use your own auth system w/ the same email address as the google account.
If your business/project is on shaky enough legal ground that you really have to worry about cease and desist letters, then I'd say you would need to look into some sort of offshore hosting. If so then your argument is against most normal hosting not just google app engine.
As for the transition path, that is a good point. Google has open sourced the spec and sdk, so someone could feasibly reverse engineer something that behaved just like app engine -- in fact I wouldn't be surprised if a serious attempt at this happens fairly soon.