@Jon

How do you handle the cases where an upgrade script makes breaking changes to the database?

As long as you have replaced all the code on all the webservers before upgrade or the 'old' webservers aren't running yet this is no problem.

If you wish to be sure, just make a maintenance window ;) most updates can be done < 15 min

make sure you have the correct settings in /engine/settings.php for the database server (so not localhost) and all should be fine and you can run as many webservers as you want

How do accomplish that? I installed the database in one server. Elgg was installed in the same server. Now, instead I want to have just a server for the database and two separate servers for the site (because of high traffic). Modified the settings.php, but got fatal errors.

The main problem I have is that the database holds the URL for the site, so you can't install elgg in another webserver/domain/ip address.

Are there any extra steps I should be taking?

@RJ you need a front machine with a single url/ip to manage the incoming traffic and distribute it to webservers machines, and back the response to the user.

Your front domain (www.example.com) must point to the front machine ip (load balancer), and in Elgg config must be the front domain (www.example.com), so Elgg doesn´t take care about how many webservers are managing the requests.

This post can be useful for you to understand the structure. http://blog.celingest.com/2014/01/31/interioridades-seguridad-solucion-problemas-elb/