It should just work. That's a fairly wide gap in versions. There may be some changes to configuration that will automatically be updated as needed, primarily due to IPv6 support where the "ip" keyword will be added or omitted, but this will take place on boot if needed. If this happens, rolling back may break things. I'd recommend that once you upgrade you replace the backup image with one that's just a revision back.
The system will always boot the primary image if available. On startup, a sanity check verifies that the image is valid for the hardware and that the checksum is correct. If the bootstrap process finds a problem with the primary image such as a bad checksum, etc., then and only then will it boot with the secondary image.
Think of the secondary as a backup should the primary become corrupt (bad flash memory, etc.)
