Your issue is exactly why i decided to make an image.
The updates (of the kernel) by raspberry pi organization for the pio handling are very sensistive as you have learned.
This was also the case for the RPI-4 but there where only compiler updates and sometime some kernel construction changes which needed radioberry kernel driver updates.
I will now and than update the image with the latest kernel updates but for now your solution is to install the image again.
What do you mis in the user space that you want to update; because that is the most important question.
When doing an update you have to check if it only contains user space updates and no kernel updates.
Making protections or other mechanism is not good in my opion ; if there are updates with user space updates you will be blocked as well.
If the kernel image in the future in relation with the pio kernel is much stable and not so fragile ; you still need to compile the kernel to make it work. So also there you are also on your own; compiling the new code base is not enough as long the raspberry pi organization does not merge my pull request with the required changes.
So i have to make a new image because of the kernel update in the latest update.
Maybe a good idea to add this information in the description that users should be aware about this.
Tnx for reporting but i am not able to help you much but i hope that this iinfo give some background info.
For short term install image and for longer term wait for new image i provide.
This image will become available at gumroad; i will report here if available.