Thanks ttfn, this was the answer. I moved the interrupt clear instruction earlier in the handler and the problem disappeared.
Eliminating the "nop" saved one cycle, which is significant for a handler executing as often as mine.
The only generic (and completely inappropriate in real applications) way to tell, is to poll the interrupt status in the interrupt controller itself until the corresponding bit indicates the signal has been deasserted, before returning from the ISR.