Have you considered building the update string inside the loop, but executing it after you have iterated all the columns? O(1) < O(n)

Also, do you have any comments/caveats on the security implication of dynamic SQL used in this process?