A quick update can be done by

apt-get update
apt-get upgrade

For general installation, updates, and so on

aptitude

is a good choice.

Anything that shouldn't be updated? Like stuff with custom patches? Does apt have a history of clobbering configs or anything?

apt-get update
uname -a                                                                # Figure out which kernel series this machine needs
apt-cache search kernel-image | grep somethingwhichidentifiestheseries  # Find the latest kernel in the series
apt-get install kernel-image-latestversion-series
vim /etc/silo.conf                                                      # Insert information about new kernel
silo
shutdown -r N

so for example:

uberjoe@davros:~$ uname -a
Linux davros 2.6.8-2-sparc64 #1 Fri Jun 10 00:38:40 UTC 2005 sparc64 GNU/Linux
uberjoe@davros:~$ apt-cache search kernel-image | grep sparc64
kernel-image-2.6.8-2-sparc64 - Linux kernel binary image for UltraSPARC (sparc64) systems
kernel-image-2.6.8-3-sparc64 - Linux kernel binary image for UltraSPARC (sparc64) systems
uberjoe@davros:~$ sudo apt-get install kernel-image-2.6.8-3-sparc64
boring debian package installation stuff
uberjoe@davros:~$ sudo vim /etc/silo.conf
uberjoe@davros:~$ sudo silo
/etc/silo.conf appears to be valid
uberjoe@davros:~$ sudo shutdown -r now

The block you need to add to silo.conf should look like:

image=/boot/vmlinuz-2.6.8-3-sparc64
        Label=debian-normal
        append="UDEV_DISABLED=yes"
        initrd=/boot/initrd.img-2.6.8-3-sparc64

Don't remove the old kernel from the file, rename it instead, just in case things go wrong. Also, make sure that the new kernel is set to be the default (default=debian-normal at the top of the file, for example).

Anything tied to specific kernel versions?

The stock Debian stable kernels have a bug in the serial drivers that make the console on Ultra 5s unusable. We previously fixed this with a slightly later version of the package (2.6.8-16), but it looks like the security update (2.6.8-15sarge1) should have the console fix, along with a bunch of security fixes. I haven't tested this version yet.