Actually, the kernel currnntly DOES flash itself "out of existance" with the existing mechanism.. the flash copy can be replaced while running with no issues.

True, but what I meant was this: The factory ".upgrade" files contain a kernel that isn't a hijack kernel. If you used the enclosed kernel and flashed hijack out of existence, then this hypothetical tricky ethernet upgrade mechanism would work exactly once, after which you're back to using serial.