You don't "control" the blockchain in the strict sense. To generate a transaction from one address to another, you must know the private key corresponding to the sender's address. Without that, the transaction is invalid, and no sane node will accept block containing such transaction.

When you have 51% of mining power, you can do a lot of nasty things(like stopping confirming transaction at all), but not spend someone else's bitcoins.

No. Transactions have to be signed by a private key matching the from address.

The double spend attack works by convincing the other party that the transaction has completed (so they release whatever escrow is in place) and then replacing the blockchain.

(But a botnet infection could watch for wallets on a computer and cause the coins in the wallet to be spent)

No. The wallets are protected with public/private key cryptography. Controlling the block-chain simply lets you control whose transactions get processed, and hence potentially allow someone to attempt to double spend their money. You could also prevent other people from spending their money entirely.