Finally after much head-scratching, I decided to restrict the DDRC to just some of the pins on the port -- before I'd set DDRC = 0xff. Well, it turns out that PC0 is a shared function with XTAL2. Apparently turning on bit 0 of DDRC turns this pin into an output, and makes the crystal stop running. Touching the crystal's can coupled 60Hz ambient noise into it, which was amplified enough to be treated like the external clock (I had suspected that the LEDs were blinking much slower than they should have been, but wasn't entirely sure)
Now I'm tempted to declare this board "working". whee!
Update, 2009-03-19: This board has been incorporated in a project. Yay!