Eu modifiquei com sucesso a imagem RPi 2 do Ubuntu Server 16.04 para inicializar em 3 usando instruções no Raspberry Pi página no Ubuntu Wiki. As instruções foram instruções gerais sem comandos específicos, segue a compilação dos comandos que usei:
$ sudo losetup -P /dev/loop0 ubuntu-16.04.4-preinstalled-server-armhf+raspi2.img
$ sudo mount /dev/loop0p2 /mnt/
$ sudo mount /dev/loop0p1 /mnt/boot/
## .img is mounted on /mnt/
$ sudoedit /mnt/boot/config.txt
## find and edit the following lines
...
kernel=uboot.bin
device_tree_address=0x02000000
...
## change to the following; note the changed kernel and commented device_tree_address
...
kernel=vmlinuz
initramfs initrd.img followkernel
#device_tree_address=0x02000000
...
$ sudo cp -r /mnt/lib/firmware/4.4.0-1085-raspi2/device-tree/{bcm2710-rpi-3-b.dtb,overlays/} /mnt/boot/
## all changes are done, now to unbind the .img
$ sudo umount /mnt/boot && sudo umount /mnt
$ sudo losetup -D
## flash the SD card
dd if=/path/to/.img of=/dev/path/to/sd-card conv=fsync status=progress