I have gotten rid of those by the rule: If a commit update updates a submodule, it must not update anything else. (Yes, this can violate the general rule that nothing needs to be added to a commit to be complete. But updating submodules has been worth the exception in my experience.)
I'm working on a project where pushing a commit to a submodule runs a CI job which updates the reference on the parent repository. This seems to lead to very few issues.
