Does drush up do a database backup/dump? Does running drush up run a database backup? From testing, it looks like it doesn't. Should I be doing a separate database backup before I run drush up to update?
To make gzipped mysql dump with drush:

drush sql-dump --gzip --result-file

Update from the wranvaud's comment: 
If you don't specify the result file it will be stored on you home folder under: ~/drush-backups/&lt;db_name&gt;/&lt;timestamp&gt;/&lt;database_file&gt;.sql.gz, otherwise you can specify --result-file='~/Documents/'