This is from a question someone else asked, but it might be useful as some sort of temporary fix for people who do not want a particular package to attempt update…
I found this on marking a package for hold:
https://askubuntu.com/questions/18654/how-to-prevent-updating-of-a-specific-package
I’d use the the “sudo apt-mark hold ...” version of this. Use the name of the package from boot which would break: nvidia-l4t-bootloader.
If you need to upgrade, then this won’t help, but if you want a safety mechanism to prevent accidental upgrade of a package which would break boot, then this should be useful.