Really late to the party...
Depending on the nature of the hard fork, you may need to do one of several things. For the sake of discussion, I'm going to call "Ethereum" the "One True Fork" as far as you are concerned (be it the Ethereum mainnet or Ethereum Classic). Without loss of generality, I am assuming you wish to move ether and not ether on one of the forks (if you wish to move ether on one of the forks, just reread this, swapping the roles of Ethereum and the fork).
You should/need to upgrade your wallet in all cases. If your cold storage device generates transactions and signs them (fancier devices with a whole UI on them such as a Ledger Blue might do this -- but I haven't looked at the manual, so I don't know if they're just fancier Nanos), then you will need to update the software on that device. If your cold storage device is a dumb USB key or a device that only signs transactions (e.g., a Ledger Nano or a Trezor Black), then the software you need to update is on the computer that generates the transactions.
Ethereum is a friendly fork of Othereum
This is what happened (less friendly at the time?) when Ethereum forked and Ethereum Classic did not. You will need to update your wallet software and everything should work fine. If you're using a hardware wallet, the crypto logic in a device like the ledger is chain-agnostic, but you may need to tell your Internet-connected device to use a different key derivation chain.
With current wallets (including those that existed when you first posed the question), you shouldn't be at risk of someone replaying your transaction onto the old network due to EIP-155. Because the ETH and ETC community found it disadvantageous to have replay attacks, they chose different chain IDs to enable disambiguation between chains (and thus are somewhat friendly).
Ethereum is an unfriendly fork of Othereum
When ETH and ETC first split, it was unexpected to the ETH developers/community that the original chain would survive, so EIP-155 wouldn't have been useful. Nowadays, we have EIP-155, but a fork could be unfriendly and deliberately choose to use the same chain ID as Ethereum. This makes replay protection more difficult.
A contract could be created that is used to determine which chain a transaction is occurring on; this can be accomplished by having a contract inspect the chain state and compare the state to a known value for each of the two chains; one could then "lock-in" the decision after a certain time. A splitter contract was created to help make things simpler during the ETH/ETC split: one could send ETH and/or ETC to a splitter contract which would then send ETH/ETC to a different account, depending on which chain the transaction was occurring on. You will probably want to move your ether through such a splitter contract after a hard fork from cold storage.
Ethereum is radical different from Othereum
Perhaps the fork is so radically different that transactions are incompatible between chains. For example, maybe ECDSA is about to become obsolete due to quantum computers, so Ethereum adopts a new transaction signing process. A cold storage device that does signing will become obsolete, too, without a firmware update. There is no worry about cross-chain transaction replays, but there will be short-term chaos.