The standard should be an A/B partition system, lile a lot of phones do. Flash B while booted to A, or Flash A when booted to B. If a flash fails, you can still boot the previous firmware.

Put your hands down, I know about security. The point is after the flash is successfully booted on the new firmware, it can be copied to the other partition to eliminate a regressive boot to old firmware.