Those are your menu entries.
Just to be absolutely sure, I have on Ansible “update” play two steps:
- update everything, except kernel&co
- update everything
That way all the packages (except kernel modules) that could go to initramfs or are otherwise involved in installation of kernel are definitely already updated when the new kernel is installed on step two.
Not sure whether that has any real effect or benefit other than the false sense of being in control.