In my experience, the database is a fairly safe bet (especially a central table like ModuleControls).  That being said, we might as well go through the API rather than through SQL.  For some reason I was thinking that SQL was the way to go, but there is an API over that table, so we might as well use it.

It'll look something like this:

ArrayList manageTabsControls = ModuleControlController.GetModuleControlsByKey("Tab", Null.NullInteger);
if (manageTabsControls == null || manageTabsControls.Count != 1)
{
    throw new InvalidOperationException("There is craziness!");
}

ModuleControlInfo manageTabsControl = (ModuleControlInfo)manageTabsControls[0];
manageTabsControl.ControlSrc = "DesktopModules/ModuleFolder/ModuleControl.ascx";
ModuleControlController.UpdateModuleControl(manageTabsControl);

This should work in DNN 4.5+.  If you're compiling against DNN 5, you should be able to use ModuleControlController.GetModuleControlByControlKey, which will just return a straight ModuleControlInfo, so you don't have to mess with casting and checking the ArrayList.

Hope that helps,

I don't know of a built-in way to tie that code in with the DNN upgrade process.

There is a possible workaround that we've come up with, however.  When you install/upgrade your site, module packages in the Install/Module folder of the site are run.  So, if you were able to keep a copy of your module's package in that folder, then it should get run on each upgrade.

Hope that helps,