Been there, done that, in 2007. My solution had a single programming connector with an extra pin.
1) The board had a jumper, that was used to select the reset line going to first or second AVR. Rest of the lines (MISO, MOSI, SCK) were connected to both.
2) The extra pin went to each AVR. The FW of both AVRs checked these pins on boot and if they were pulled low, the mcu FWs stayed in infinite loop and did not initialize the SPI pins as outputs. On the programming plug, this pin was shorted to GND. So when the programmer was plugged in, neither of the uc's started to boot. This way, nothing messed with the programming operation.