A pullup on anything other than CS is a wasted part. Using the '328 internal pullups on the card detect pins is sufficient.