I’ve been troubleshooting the issue a bit more, and it looks like I might have no choice but to bridge the LAN and WAN interfaces, according to this thread: http://forum.mikrotik.com/t/help-setting-ipv6-with-japanese-isp/130202/25
I’m in a similar situation as that thread, using a Japanese ISP, except using an IPIPv6 tunnel instead of PPPoE, and not having to use bridge filters.
I did get the IPv6 firewall to to work even with the interfaces bridged though, by enabling “Use IP firewall” in bridge settings. Not sure if this has a performance penalty on connections within LAN, but it works, and connections from my devices do get listed in the IPv6 firewall connections list.