The way I upgrade is as follows:
The following assumes the blog is at location other than /wordpress, which I always do, just so I can do this upgrade method. And I use the shell in linux.
Then I poke the upgrade process, in 2.0.3, that's logging in and clicking the upgrade link.
In English, the above means: change the name of the dir from blog to wordpress, which hides the blog from visitors, but it's not for long; get the update; unpack it right on top of the old files; set proper owner and group, and do all subfolders etc.; change the name back to blog (or whatever).
Since it's hidden from users, I don't need to worry much about them posting comments while I'm replacing files. And then I immediately do the upgrade after changing the dir back to the normal one. It's never been a problem for me, and I've done this at least 40 times, between various blogs and versions.
I never modify wordpress core files, which lets me just write on top of the old files without worry.