I was able to figure this out by trial and error. The boot image that you normally write with uuu can be written on the target from Linux using:
# echo 0 > /sys/block/mmcblk0boot0/force_ro
# dd if=<image> of=/dev/mmcblk0boot0 bs=1024 seek=33 status=progress
# sync
# echo 1 > /sys/block/mmcblk0boot0/force_ro
So the boot loader starts 33K from the beginning of the boot0 partition.
It would be nice to know if you could use the boot1 partition as a backup partition, but that doesn't seem possible. I suppose you could write a small firmware loader that ran in boot0 that would load from boot0 or boot1. But that's kind of a pain.
I don't know if this will work on other boards, but I assume they have something similar.