lookupCommit assumes the thing is a commit.  That should be true, but someone may have manually done something in the repository to make HEAD be a non-commit.

You should use parseCommit here and take the parsing hit in order to ensure the new parent is actually a commit.  Otherwise we might create a corrupt object where a parent points to something that isn't a commit if HEAD was mangled externally.