At least to use dom0 'exclude' options, not VM one. Especially to not exlude kernel and xorg updates...