There are multiple options available.
1. Updating to 4.x via game card, then installing MSET exploit, creating emunand (via GW Launcher is easiest), then installing rxTools MSET and get rxTools (I recommend 9/28 nightly but 10/02 is supposed to be good too.)
2. Updating to 6.x via game card, similar to the previous one, except you can't use GW Launcher (don't think it works on browser under -7), but Decrypt9 can backup sysnand and I believe create an emunand partiton + write copy of sysnand to it so you don't need GW launcher for it.
3. Updating to 9.2 via game card, using Cubic Ninja with Ninjhax2 to load rxTools (can use Ninjhax2 to load Decrypt9 as well so you can backup sysnand and create emunand.)
As I don't think GW Launcher go.gateway-3ds.com exploit works on browser lower than -7 (someone might have to try), updating to 6.x or 9.2 will lock you out of using GW Launcher. However, there are alternative methods for dumping sysnand and creating emunand which aren't that much more difficult I don't think, but you don't have to risk updating sysnand with sysupdater (should be risk-less if you use rxTools devmode/pasta mode but yeah.)
Then you can go back and install missing system titles such as AGB_FIRM and the browser that aren't included in gamecard updates (any titles you may be missing, I don't know which ones may be missing.)
Same deal with updating to 6.x, but with 6.x you can still use rxTools MSET. You would have to install Decrypt9 MSET with your DS flashcard and then load Decrypt9 Launcher.dat to backup sysnand and create emunand, then switch to rxTools MSET to do the install and then use sysupdater to update with the 9.2 update files (only in rxTools devmode/pasta mode — NOT rxMode sysnand as it will brick.)
Updating to 4.x is the one people recommend but the other two work too. 4.x you can directly use GW Launcher with MSET exploit while updating to 6.x or 9.2 you'll have to use Decrypt9 for emunand but both should work.
The reason why I'd recommend just going straight to 9.2 is because I personally had problems with rxTools when I was using MSET exploit with 6.x, while everything worked 100% fine booting through *hax 2.5 (exact same install, only difference is I had updated sysnand to 9.2 and changed entry point from MSET to *hax via menuhax.)
You'd be missing some optional system titles, like I -think- AGB_FIRM came in 3.0.0? So you wouldn't have it and would have to install manually. Would also be missing the browser, and depending on the game card used to update it may just update to a stub browser entirely which would ask you to update the system if you tried using it. But it should be possible to boot in rxtools pasta mode/dev mode and install missing system titles (may be more trouble than it's worth, admittedly.)