I have played a little bit with update from SD-card with other 
controllers and this ist the basic concept I have used:

- Try to add some extra checksum/crc/similar and version information in 
a second file or use a extra record in the hex-file. In my experiments I 
have used a "metadatafile" with CRC16-Checksum, Version, Numb. of bytes 
and filename of a binary file on the card which contains the 
application's code. I have used raw-binary to avoid parsing of hex-files 
in the firmware.

Some kind of Bootloader with functions to read and browse the SD-card 
should be installed at the start-address of the internal flash. The real 
application is located "behind" this.

Bootloader:
- retrieve the version of the current version, could be a number located 
at a "fixed" address
- browse the files on sd-card to find the latest firmware code-version
- if latest firmware on card ist same or older than the on ein flash, 
continue normal operation
- no newer version available verify that the checksum/crc of the file on 
the card is correct
- if correct start the update procedure, if not jump to main application
- update procedure: parse the content of the hex-file and convert it in 
binary-data, upload the binary data to the internal flash using the IAP 
functions documented in the LPC23xx manual. Keep the memory layout in 
mind (sectors, pages). Write the version to the "fixed" address.

The main application should copy it's exceptions vectors in RAM and 
Remap since the start of the flash is already occupied by the exceptions 
vectors of the Bootloader. The main application should be linked to an 
adress behind the bootloader. The bootloader can be started from the 
main application by watchdog-reset or maybe by a simple "branch to 0x0"

Hope this give at least a rough idea.