Can string lookups be vulnerable to timing attacks like array lookups are? Per “Can non-assembly crypto libraries truly be secure against timing attacks?”, array lookups are vulnerable to timing attacks. Like, if you do cresult[map[i]] and map is an array and cresult, is a string then map is vulnerable to timing attacks because it's an array but is cresult?
Yes, string algorithms can be vulnerable to timing attacks.

A very common example is string comparison. The best performing way to implement it in general is to compare two strings one character (or memory word) at a time and return inequality as soon as they don't match. However, this kind of a routine is vulnerable to timing attacks that can find the (approximate) length of the common prefix. Using such a string comparison routine to compare passwords or hashes has lead to attacks (an early 1970s example, a random 2009 example).

Similarly, when you are using a multibyte encoding, simply looking up a character in a string can allow timing to reveal details about the string before then.