How do I prevent kernel updates from bricking my CM4 DevTerm?

Yes, if you use the stock image, though I recommend you use Rex’s Bookworm image: https://forum.clockworkpi.com/t/bookworm-6-6-y-for-the-uconsole-and-devterm/

It has an upgraded kernel and several recommended fixes are included by default, including one to prevent other kernels from being installed.