I believe you can't change the kernel because the (locked) bootloader checks a cryptographic signature on the boot partition before it'll boot it.
You can replace the recovery partition, I thought, but during a cold boot the boot scripts rebuild it from the boot partition. (See /init.rc calling /system/etc/install-recovery.sh although I have no such file on my running phone, I presume it's erased or over-mounted...)
That's why you can battery-pull if your replacement recovery is broken, as long as it doesn't prevent reaching that far into /init.rc...
Paul "TBBle" Hampson
Motorola ME863 (Retail HK, OTA 2.3.6 60.2.200.ME863.Retail.en.05 + rooted + safestrap), HTC Dream (Optus AU, ADS_Magpie), Huawei IDEOS X3 (Vodafone AU, CM7.2-rc1), Nexus S (Vodafone AU, still in box)