Just some further feedback on this, in case someone comes across the same problem:
Once the Kindle booted properly, I registered it and checked that the firmware it was running was 5.0.0 - as expected with the "forensic" drive image.
I then uploaded the most recent Amazon firmware (5.0.4), making sure it was transferred to the device properly before disconnecting it from the PC.
Running the update went fine until reboot. This time there was no "Your Kindle needs repair" message, but it got stuck on "Please wait for your Kindle to reboot".
After about 2 hours of leaving it sit, I rebooted into diags using Mfg Tool, connected via SSH and once again ran
"dd if=/dev/zero of=/dev/mmcblk0p3 bs=4"
The Kindle then managed to boot and came back as a new, unregistered device. The firmware version is back to 5.0.0.
Can anyone shed any light on why the update fails like this? Is it possible to go from 5.0.0 to 5.0.4?
I will refrain from updating it for now. Needless to say, I'm not all that keen to update the second KT, which is running 5.0.1, either.