Why are URL encoded values in $_GET variables broken?
Sounds like your incoming data is ISO-8859-1, not the other way round. Drupal is always in UTF-8 (and utf8_encode converts from ISO-8859-1 to UTF8).

This is what I get when urlencoding Ü.:

$ drush ev 'var_dump(urlencode('ü'));'
string(6) "%C3%BC"


And when urldecoding and utf8 encoding %DC:

$ drush ev "var_dump(utf8_encode(urldecode('%DC')));"
string(2) "Ü"


Makes all perfect sense to me.