OK I think I understand how it works now. Installing a new package triggers /usr/bin/update-menus which runs as root and set USER_MENU=0
/usr/bin/update-menus runs through the files in /etc/menu.d and will write the system wide menus (not the user menus) it will touch the file /var/lib/menu/.menu-updates.stamp so when users log on they can detect the change.
When a user logs on the file /etc/X11/xinit.d/menu is run which detects the presence of /var/lib/menu/.menu-updates.stamp and runs update-menus again this time with the -u option which forces the creation of user menus in your /home
At no point does it try to test if you have edited your own menu. The scripts do what they are intended to do. It is just not what you would like them to do

If you change the menu file in ~/.fluxbox.init you can use your own menu definition.