I have also had problems allowing updates. In my case it usually means that there was a generic kernel 'upgrade', and that seems to break several things on my system. I seem to remember that menuconfig can be used. I guess I need to find out what tweaks are needed for my graphics processor and laptop to be happy and store them in a text file. Then when ever they push another kernel on me, go back to menuconfig and the text file set things right. But it seems easier just to refuse kernel upgrades for quite awhile, until I am worried the system may have too many exploits that have become better known and it is time to plug any possible leaks.