Block Satellite updates with higher version then primary server

We accidentally updated a satellite server with a feature update that was higher in version number than the quality update that was just done on the primary server. Without any notification that the primary server was a lower version or that the database schema had not been updated yet, the satellite was updated with a higher version than the primary. I would like to see a check before the update that would make this situation impossible. Fortunately we saw this issue right away and were able to update the primary without any issues but I would expect that satellite servers can never be a higher version than primary servers.