If a malicious internet service provider completely controls a user's connection, can it launch a double-spend attack against the user? How much computational effort would this take?
Everything sent over the Bitcoin network is public so you have nothing to worry if your ISP monitors your connection (only related to bitcoin transactions; your privacy is compromised in other cases). The only thing which is private are your keys, but that is not sent over the network. Now, if your ISP controls everything that moves through its servers, it can definitely change the components of the transaction. However, when you create a transaction, you sign the entire transaction with your private key. So, if any component of the transaction is altered, that signature is rendered invalid and hence the entire transaction becomes invalid. So, no even if your ISP controls your entire network, it cannot alter your transaction without invalidating it. Just ensure that you keep your keys safe (cold storage like hardware wallets or paper wallet).
If a malicious internet service provider completely controls a user's connection, can it launch a double-spend attack against the user?
No. The transactions that users create all require a digital signature. Creating a valid digital signature requires the private key for the public key that is specified in the transaction. Because that public key is fixed (i.e. cannot be changed), the specific private key(s) that the user has are required in order to modify the transaction.
An ISP does not have that user's private keys. So they will be unable to produce a conflicting transaction as they will be unable to create a valid transaction. They cannot produce a valid signature, so a double spend cannot be made.
The only thing that an ISP can do is censor a user's transactions. All they can do is block network traffic to and from the user as everything in Bitcoin is self contained and proves itself to be valid (or invalid).