M is not Hermitian semidefinite. In fact, it's not even Hermitian.
Moreover, norm(u) == 1 (or 2) is a non-convex constraint.
norms(u) = 2 is not what you intended. You intended norms(u) == 2, which will be rejected due to being non-convex constraint. norm(u) = 2.would be rejected as an illegal construct.
Using CVX Beta 3.0 Build 1177,
were both accepted by CVX, but I don't know whey they were because M + M' has eigenvalues -0.0150, 0.2804; hence is indefinite.
However, these are rejected if u is declared complex (which you did not do).
I am interested in what @mcg has to say about why minimize(u'(M+M')u) was accepted. But if u is declared complex, it is rejected.