For my tests (I only have it on one machine so far), I left N at 2, which
is sufficient to catch a single 'bad' kernel if one makes it through release.

I must admit that in SL3/SL4 we used a different update mechanism which only
ever left 1 kernel on each machine which in fact was always sufficient here
though we did occasionally get the odd scare...

 -- Jon