The rule of thumb I've always used is that for flagship phones, 2 years of updates is common. For lower grade devices you should expect maybe only one update from what it ships with.
There really are no rules for updates, though. Manufacturers/carriers aren't obligated to provide you with newer versions of the OS at all. Now, don't confuse system updates with bug fixes, although many times the two are incorporated in one package.
If updates are important to you, then look into a Nexus model or a Google Edition Phone as these will get updates directly from Google as long as the hardware supports them.
Or, if you are into modifying your device, then as Funky points out, custom roms usually always take a legacy device a few releases further out than either the carrier or manufacturer. I've got KitKat running nicely on on an old Asus T-101 tablet that only got updated to ICS. The more popular the device, the more likely there will be development for it, so you'll want to stick with brand names and higher end models.