Ken was right. Removing sasl_minimum_layer from imapd.conf solved the problem... sadly. Maybe someone else will find my write-up next time: http://www.kickflop.net/blog/2007/08/06/thunderbird-kerberos-for-windows-and-cyrus-imap/