Note to self
I forget this every time I go to upgrade Drupal, because it's so simple, and spend an hour trying to make absolutely sure I have it right and haven't missed anything. So assuming you're deploying Drupal with git (with the contents of sites/ untracked, presumably), all you have to do is:
git fetch
git rebase origin/7.x
drush @sites updb
Optionally, you can do a git hard reset to the latest tagged release.