I used lenny with kernel from squeeze through backports. Then I upgraded to
squeeze. It was strange to me that after reboot, the machine still booted
the kernel from backports and not the one from squeeze.

The versions of linux-image packages:

$ dpkg -l | grep linux-image | grep 2.6.32 | awk
ii  linux-image-2.6-amd64                     2.6.32+29
ii  linux-image-2.6.32-5-amd64                2.6.32-35squeeze1
ii  linux-image-2.6.32-bpo.5-amd64            2.6.32-31~bpo50+1

I traced it to line 185 in grub-mkconfig_lib file, where /boot/vmlinux-*
filenames are compared using dpkg --compare-versions. If however the regular
expression on line 173 of the same file gets "bpo" alongside "pre", "rc", "git"
etc., it seems to resolve the issue (but I did not test it extensively to
make sure it does not introduce new issues, nor have I any intimate knowledge
of the "bpo" package naming scheme).
buggy logic is present in the unstable version of the package as well
(the line numbers there are 218 and 206).

So this is probably a bug in the debian/patches/dpkg_version_comparison.patch
source package file.