Currently, 3.5.0a1 needs to be manually removed either before or after installing 3.5.0a2 (after *should* be okay, but before is preferable). Installing a later version should detect and remove the earlier one. This is obviously an installer bug.
Looks like the way I was calculating the version number of the installer didn't take into account a2 and a3 - we had 3.5.0.10 for 3.5.0a*. I think switching to (Major).(Major).(Major).(Minor).$(Field3Value).0 is correct here - this should give us 3.5.100.0, 3.5.101.0, 3.5.102.0 for 3.5.0a1-3, then 3.5.1100.0 for 3.5.1a1, etc.
Two parts to this - first that I was using the wrong version, but also the wrong upgrade code for the bundle. Those are both fixed now, but it does mean that both 3.5.0a1 and a2 will need to be manually uninstalled. It is possible to add a list of the upgrade codes that have already been released and remove those too, but since they are only alphas I'm not worried about requiring manual uninstall of those versions.