The easiest answer on your question is probably something down the line of "What you can do within the browser is unlikely break with the next update".
General rules used:
1. No custom master pages (the new look doesn't use these)
2. Custom branding do you really need it? The theming like solutions are qutrie often a more relaiable option.
In the past we used to inject javascript etc and this broke with recent updates as site custom action are on the way out.
So even if you say we don't want things to break I would recommend to go down the development route!
If you look at the app model ( an interface that talks to SharePoint but isn't SharePoint) then you are at quite a low risk.
