add --fix-broken to final `apt-get upgrade` just in case

I mistakenly had it on `apt-get update`, where it does not do anything.