If existing modules are compiled without an option, can't replacement modules be created, with (and I know this is ugly), some .deb compatible postinst which switches the existing modules with ones compile with that in, as well as the stock masq .ko files which is lacks altogether but which it's possible to compile and install in normal dpkg ways? Or, I know somebody who refuses (for h/ware reasons) to reboot a server he's had running for 15 years or so, where he insmods various catchup .ko files which patch together all the updates to the 2.2.*? kernel to keep it secure, you can essentially update most kernel internal symbols and capabilities, so adding nf_conntrack in a fresh module might be possible.
I wonder if this is any less ugly than a custom kernel, we can flash the kernel OTA directly from deb anyway so from user-experience POV it's the same (except reboot vs no reboot).