According to https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki a 12 word BIP39 passphrase has entropy of 128 bits.
My reason for doing so is that when I want check if I memorized my passphrase correctly, I could just check it against the hash instead of having to generate the HD wallet addresses and checking its balance.
So is it safe to store a double sha256 hash of my BIP39 seed on the blockchain?
You could and it's probably not a direct security issue, but it's a senseless waste of time trying to find it again. Keep in mind that doing this destroys the PBKDF2 key stretching used in the seed needlessly. Electrum stores a checksum with their 12 word seed (making it a 13 word seed) if you really desire that functionality, though it's clear if you have it right when the money in that wallet is restored.
It is probably not a serious risk, assuming your passphrase really does have as much entropy as you say, though it doesn't seem to offer many real benefits either. If you want to be able to check if you remember the passphrase, why not just keep the hash somewhere that only you can access? Making it public can only increase your risks (though probably not significantly).
The main difference is this. Suppose your passphrase has N bits of entropy, and someone is trying to brute-force it.
If they have access to the hash, then for each phrase they try, they only have to perform two SHA256 computations. Such operations can be done relatively fast, e.g. by some variant of a mining ASIC.
If they don't have the hash, then for each phrase they try, they have to compute a seed from the phrase, generate a sufficiently large number of private keys from the seed, compute their corresponding public keys and addresses, and look them up in a blockchain index to see if any of those addresses contain coins. This is going to be many orders of magnitude slower than just computing 2 x SHA256.
So publishing the hash significantly reduces the amount of work a brute-force attacker would have to do.
Now, if your passphrase really does have N=128 bits of entropy, then the distinction is not really meaningful, since computing 2^N iterations of SHA256 is still effectively impossible. But if there is some possibility that N could be much smaller (e.g. your RNG is buggy or compromised), then in principle, publishing the hash could be the difference between a brute-force attack being cost effective or not.
