Okay, so I'll answer myself. The places.sqlite file which is located in the profile directory (find it with Help->Troubleshooting Information->Profile Folder) contains the bookmarks. When Firefox opens this database file, two other files are created - places.sqlite-shm and places.sqlite-wal. These are normally deleted when Firefox closes and updates the places.sqlite file. For some reason, the journal files (the -wal and -shm files) were not being deleted. Maybe windows crashed with them open at some point - I don't know. Firefox clearly doesn't correctly handle the unexpected existence of these files. I deleted the two journal files and can now add bookmarks and they survive a Windows shutdown. I still don't understand how Firefox reverts to a previous version of the database on Windows restart when the journal files already exist, but it's clearly a situation which will frequently exist (you've never had Windows crash with Firefox open?), so Firefox should handle this more gracefully than just sitting back and ignoring your new bookmarks.