It's a bit late for you now (I imagine), but as an Android fan I make sure and only buy phones from manufacturers that I know provide regular security updates. In the past I've had phones that received effectively zero security updates over the lifetime of the device, and I didn't want to have to worry about that again.
To be clear the reason this happens is because android is an open source system used by the phone manufacturers, and there is absolutely nothing that forces them to update their phones in a timely basis. Many manufacturers make their own changes on top of the stock android system, which means that an update isn't even a simple matter of passing along updates from google. Instead they would have to incorporate any changes to the android system to their own builds, verify that everything still works, and then deploy the new bundles. It can be a very time consuming and expensive process (unless the manufacturer specifically plans for it before hand), and the fact of the matter is that most people don't care. So until there is a clear push from consumers for regular updates and better security, it isn't going to happen. To be clear, that level of consumer-driven demand is never going to happen.
Here is a (fairly) recent list of devices that actually get updates:
Also, here's an article that gives you an idea of what the state of affairs looks like, and the fact that even google isn't very happy about it:
Keep it in mind the next time you get a new phone. In the meantime, the other answers here have some great tips for right now.