The issue with app certification comes from Google's approach to Java in the first place.
Sun had a vision of Java having _perfect_ platform independence and a _theory_ on the right way to do this on mobile devices.
Google had a different vision - and I'm not saying that they were wrong - but it did require Java programmers to re-think a little.
On top of that, the kernels vary by handset / maker - so you'll find that the ARM4/ARM7 processor models are alive and well in the Android Software Developers Kit, the truth is that there are some interesting processor differences in the real world - as well as how makers approach those differences.
And while the essence of the Android kernel is based on the Linux kernel, the Android kernel was a branch off the mainline that cause all sorts of infighting between the two communities - and has only _very recently_ started to be fully reconciled. (This seemed to center around - surprise! - power management.)
Here's a few interesting links, not really required and maybe revealing only in the sense that it might open a door to those interesting in reading / studying further. I've gone back in time because some people find how we got here to be helpful sometimes:
Android vs. iPhone: Why Openness May Not Be Best
Java Droid | Java.net
Initial Thoughts on Oracle vs Google Patent Lawsuit - Miguel de Icaza
How Much Linux Is in Android? - Linux Magazine Online
Google's Android code deleted from Linux kernel - The Register
Garrett's LinuxCon Talk Emphasizes Lessons Learned from Android/Kernel Saga | Linux.com
All of that adds up to great difficulty creating an app whitelist that we _all_ want.
If I can think of a way to solve this problem - I will.
Bottom line for me is that 4 or more stars are nice - _but_ I look first and foremost at EVO user comments and trust those over an aggregate comment score - and - practice your backup / restore processes, because even a good dev can introduce a boo boo that totally frags your phone.