This is what I did (using initfs_flasher directly, not bootmenu package) and it worked fine. But it does seem risky: If the old user space can't work with new kernel and initfs, step 3 will result in non-booting system. The safest way is to update flash first, so you have lower risk of that.