I used the lunch break for a test and here is a workaround:
1. Insert a 2nd controller and press ctrl-c to stop autoboot, leave it in the loader prompt.
2. Plug in one SAS cable from controller A 0a to controller B 0b
3. In sysconfig -a you should now see disks on both SAS HBA's and FW infos for both IOM's.
4. Start a FW update and wait.
5. After a few minutes the FW update finishes on both modules. Now the 2nd controller can be removed.
All can be done online and isn't disruptive. It will only result in a Autosupport message when the 2nd controller is removed, because the disks have lost the redundancy...