This really looks like this:
If so, yes, this is a known problem (and I am not sure how to fix it
, but there is a workaround in the bug report as well.
I think it is to do with how we have versioned the kernel package.
The normal debian kernel has a version number that gets bumped when
modules become incompatible.
The distro tools automatically prevent linux-image-4.16.0-1 from being
removed during an upgrade (assuming it met the properties requires to
be protected, such as being the running kernel). In our case all the
unique numbers are exclusively in the version number so the distro
scripts don’t protect our kernels in the same way.