A quick update can be done by

apt-get update
apt-get upgrade

For general installation, updates, and so on

aptitude

is a good choice.

Anything that shouldn't be updated? Like stuff with custom patches? Does apt have a history of clobbering configs or anything?

apt-get update
uname -a # Figure out which kernel series this machine needs
apt-cache search kernel-image | grep somethingwhichidentifiestheseries # Find the latest kernel in the series
apt-get install kernel-image-latestversion-series

so for example:

uberjoe@davros:~$ uname -a
Linux davros 2.6.8-2-sparc64 #1 Fri Jun 10 00:38:40 UTC 2005 sparc64 GNU/Linux
uberjoe@davros:~$ apt-cache search kernel-image | grep sparc64
kernel-image-2.6.8-2-sparc64 - Linux kernel binary image for UltraSPARC (sparc64) systems
kernel-image-2.6.8-3-sparc64 - Linux kernel binary image for UltraSPARC (sparc64) systems
uberjoe@davros:~$ sudo apt-get install kernel-image-2.6.8-3-sparc64

Anything tied to specific kernel versions?

The stock Debian stable kernels have a bug in the serial drivers that make the console on Ultra 5s unusable. We previously fixed this with a slightly later version of the package (2.6.8-16), but it looks like the security update (2.6.8-15sarge1) should have the console fix, along with a bunch of security fixes. I haven't tested this version yet.