After a discussion with support I decided my new upgrade procedure will be:
Download img for current install version (if I don't already have it).
Download img for new release.
Backup my config.
Run the upgrade from the console.
If it is successful -> done
If it fails install the img from the new release with the retain config option.
If the new img is successful but the config failed restore the config from backup.
If the new img install fails do #6/7 using the old img.
Determining what is successful can be subjective or could take a while to realize. Fortunately our firewall configuration is somewhat static so we can run on a new release for a while and still roll back relatively easily.
For major releases (21.02) I'm leaning towards going directly to a img install on those.