How can I ensure that application-level variables are not updated by more than one user simultaneously?

Use the HttpApplicationState's Lock and UnLock methods.

For more details refer : MSDN: Application State