Then, Rhodry, I don't quite get how you lock the kernel version. The only way I know is package > force version in Synaptic, but I've only done that for very minor programs. Does it make sense to do it for such sensitive packages as linux-headers-xxx?
Well, I run the Liquorix kernels on most machines. They are obtainable as part of the Smxi script. As well, within those kernel options there is an option to remove "meta" packages. For Debian this is the 'dkms' packages associated with kernels etc. It is these packages that generate the automatic updates. Remove them and the system just has the installed kernel ( & headers) packages (ie is locked/does not try to update).
The trouble with dkms type stuff is, for example, a kernel update will want to update the nvidia driver BUT it will always choose the latest nvidia driver in the repos. When you get a kludge like 295.40 ( nvidia said they knew it was retrograde for many systems) you go backwards performance and/or bug wise. I don't say I never upgrade but I want them under MY control, having read & researched before such an important change to my systems. Also, I never upgrade my kernel without a known working option already installed to fall back on if necessary. The nvidia updates are just "run the script" against the new kernel.
The 3.0 kernels for example simply would not even boot on some of my hardware, yet I have run 3.3 kernels and in fact 2.6.38 kernels on the same hardware just fine.
Also, you can pin specific packages in '/etc/apt/preferences' with a priority of 1001. That will lock the version from command line upgrades - I never do any other sort. Read up on "Apt Pinning" in the Debian wiki & some other threads in these forums. It is a very powerful tool.
I am very tired, I hope this makes sense - basically read & follow the Smxi script very carefully and you too will once again control your system!
Life isn't about waiting for the storm to pass...
it's about learning to dance in the rain.