Thanks. I might have a look into doing it for mine, since that seems to make sense. I guess like you said you can just mount the fs rw, and then chroot in to run updates.
No need for chroot, I just say in when I'm on the LAN, remount / and /boot r/w, run the updates and reboot (boots any new kernel and switches back to r/o).