Shortcode coming out at the top of content rather than in place where I require it
You want to return all the text rather than outputting it then and there when you are escaping PHP.
At the start of your thelist() function start an output buffer with
ob_start();
Then at the end close this buffer and return its contents with
return ob_get_clean();
That will return the content rather than echo it straight away, which is what you want to do in the case of a WP shortcode