To answer the question you originally asked: whether or not you're running untrusted code, if you want to protect against Meltdown or Spectre, you still need to upgrade your kernel, even if your cloud provider has patched the underlying hypervisor.
The GCE customer announcement (linked from the Google security blog post, which is a bit light on detail but also links to the project zero writeup which is full-on) says under “Mitigation Status”:
Infrastructure patched against known attacks. Customers must patch/update guest environment.
If you don’t trust Google, AWS has their own security bulletin which states:
While the updates AWS performs protect underlying infrastructure, in order to be fully protected against these issues, customers must also patch their instance operating systems. Updates for Amazon Linux have been made available, and instructions for updating existing instances are provided further below along with any other AWS-related guidance relevant to this bulletin.
The reason why this is necessary is because paravirtualization allows the guest kernel to have control over the TLB in the CPU directly, without mediation from the hypervisor (it’s one of the major performance improvements of paravirt over full virt, along with direct I/O). Thus, if the guest OS kernel doesn’t implement the mitigations, processes running in the VM can still grab data from the kernel and other processes running in the same guest.
The answer to the second question you've edited your question to add, as to whether you're at risk from your neighbours, appears to be, with the information currently available, "no". The answer to the third, seemingly implied question, of whether you should patch now or in your regular patch cycle, isn't answerable with the information you've provided, as it is deeply rooted in your own organization's risk profile and threat models, and I'd go so far as to say that you're bordering on "primarily opinion-based" with that one.