Thanks to all who responded.

Despite hearing about dependency-based boot functionality, I
had presumed that run-level information was sufficient for a
service to start.

Adding the dependency information as per Olaf's reply, the
firewall starts correctly on boot.

In the process I learned a little more about sysvinit
runscripts and their symlinks, also about event-based
networking scripts.

--
Joel Roth