This is a typical issue faced by most programs that update files on live file systems and there is no golden solution. Package managers also have to take great care here, and my advice would be to follow their example: Make sure that the update module is aware of how the files are being used, and disable the service during the update. For many services, this will be a systemd service or a SYSV service script.
This is obviously not possible for very generic modules, such as the
directory module, since it can install files anywhere on the device. In this case I would consider forking it for its specific purpose and then add the service aware sections to the fork. Some sanity checks would also be good to make sure you cannot install files in just any location.
Another alternative would be to use state scripts, but if disabling the service during an update is something that has be done for every update, then I think the module fork solution is better.