There's no built-in process to roll back a hotfix or upgrade that I'm aware of. Hotfix 7, for example, doesn't have any rollback instructions, but directs you to reach out to Support. My advice would be as you suggested: snapshots/checkpoints (at a minimum), but a full backup if you can.
As for the log data portion: Agent data will be automatically queued locally if communication is lost with the LEM during this process and will resume once the connection is restored. If you are primarily dealing with Syslog data and want to queue that, your best bet is to use Kiwi or a Linux-based Syslog server where the agent can then read the data. This will cause the same effect, the agent will queue the data automatically on the Syslog server if the connection is lost and then resume playback afterward.