"Flashing" custom recovery from running ROM
In response to my own question: yes, you can flash a custom recovery from a running OS. The recovery, since it isn't mounted, should be fine to write:

dd if=openrecovery-twrp-2.7.0-deb.img of=/dev/block/platform/msm_sdcc.1/by-name/recovery


You run the above at your own risk and I accept no responsibility for what you do with this.

Do note, however, that if you have a locked bootloader, it will prevent booting because it will see that the recovery's signature is bad.