i used synaptic to lock them, but i must have missed something, because it upgraded them anyway
You probably still have the linux-image meta-package installed and the default behavior with debian is upgrading the kernel as long as the version number doesn't change.
If I recall correctly this isn't the way it's done with FC - but my Red Hat/FC days seem like pretty distant memories these days

Do you have a preferences.conf file?
Yes I have one actually, but not in /etc/apt, it's stored in /var/lib/synaptic and it effectively contains info about all the version-locked packages.