I'm wondering if there is any technical reason why you would want to limit the kernel a customer ran?
Relevant:
- https://www.digitalocean.com/community/questions/do-you-update-kernels-sometimes
- http://digitalocean.uservoice.com/forums/136585-digital-ocean/suggestions/2814988-give-option-to-use-the-droplet-s-own-bootloader-