This seems like one of those things that is very hard to get right: https://forums.aws.amazon.com/thread.jspa?messageID=823033
I'm kind of shocked Amazon doesn't have something like Linode's Fennix, but you can always do an EBS snapshot of your /boot volume and revert it if a kernel upgrade breaks stuff.