How practical are side-channel attacks and how much of a concern are they? I see a lot of research in very sophisticated side-channel attacks on crypto systems. Most (but definitely not all) seem to follow a trend, namely, the crypto system does something very dumb like decrypt any block given to it with no IV or nonce (so usually ECB mode).

That said, there have been practical attacks against smart cards and timing attacks against RSA.

So, when building a system which uses cryptography (be it public or symmetric key), how practical of a concern are such attacks? And, what guidelines can be followed to determine if your systems needs protections (be they power analysis protections, emissions, timing, etc)?
Yes, side-channel attacks are practical and a real concern, if the past is indicative of the future.
I've been professionally involved with Smart Cards since the mid eighties, and have repeatedly witnessed deployed systems vulnerable to many forms of side-channel attacks; examples (I personally did 1 and 3):

RAM buffer not cleared at reset, readable (with standard command Get Response), leaking state of previous PIN comparison, even if incrementing the PIN presentation counter had been inhibited (by hardware reset or/and removing EPROM programming voltage); that allowed recovering the 4-digit pins with expected 5000 attempts.
Timing dependency where the duration of PIN presentation with permanent-memory writes inhibited leaks if the PIN is correct or not, to the same effect.
Timing dependency where the duration of a comparison between values leaks the index of the first incorrect byte, allowing finding an $n$-byte value with expected $n\cdot2^7$ attempts instead of $2^{8\cdot n-1}$.
Return to manufacturer test mode (by a software exploit, hardware modification or upset), allowing extraction of permanent memory content, including secrets (variant: normal software can be coerced to read the wrong location).
Micro-probing to spy on bus lanes, leaking all kind of secret information.
Simple Power Analysis directly leaking bits of exponent in RSA.
Simple Power Analysis leaking activity (e.g. start programming of permanent memory), which combined with timing measurement leaks sensitive information (e.g. good or bad PIN, before that is recorded).
Differential Power Analysis, allowing key recovery.
Fault Injections (often considered side-channel attacks).

I have seen this causing great embarrassment to the suppliers of the vulnerable Smart Cards, and believe multiple reports that in the (distant) past, such vulnerabilities occasionally have been exploited on a large scale, especially in the field of Pay-TV with Smart Card.
More generally, when a device using cryptography is broken, this is often by means better described as a side channel attack than a cryptographic attack.
Addition: check this introductory article's part1 (alt.), part2 (alt.), part3; and this 2012 paper showing remote SPA and DPA attacks on Smart Phones and PDA.

If a cryptographic device/system can get in the hands of the adversary or otherwise become accessible enough (timing/Tempest/DEMA/SPA/DPA attacks can be remote to some degree), and it contains any information which confidentiality or even integrity matters (such as secret/private keys, authenticators, counters..), then one needs to pay close attention to side-channel attacks.