|Robot101’s description is pretty much what I do for remot upgrades, except.
I log in twice, becoming root both times.
I upgrade ssh:
apt-get install ssh
I log in a third time, and become root, to prove that ssh is still accepting connections, and all’s well.
I upgrade screen with apt-get.
I run screen, and then do the upgrade in the screen session (using your favourite upgrade method).
after I finish, I make sure I can still log in before logging out from all the root sessions.
That’s it. Paranoia is your friend.
BTW It can also be useful to have a spare login with it’s home on /var rather than /home, so you can log in remotely and them unmount /home.