Cisco 2500 series controller keeps dropping devices

You are correct in that the upgrade tool is for older access points than the one you have. On the newer access points you can just tftp a lightweight firmware image. The difference is the newer access points have a "manufacturer installed certificate" or MIC burned into the flash. The conversion tool creates the certificate on the older access points. This is why the download for the conversion tool is listed only under the older access points.

Cisco documentation, description under "LAP Authorization"

I would check your configuration in ESX.

A simple way to tell if your ESX config is broken would be to add vlan 99 onto Gi0/1 (towards your host) and set it as the native vlan (like you did towards your router). This will prevent untagged packets from ending up on a vlan that connects to Fa0/1.1 of your router and confirm that your vSwitch config needs examining.