Is there any way of persuading my 2820 to log inbound pings?

I've tried allowing PING from the Internet, and setting up a firewall rule to block and syslog any inbound ICMP, but that didn't seem to help (indeed, the pings were still responded to, which is curious in itself).

The firewall is between the WAN interfaces and the LAN interfaces you would have to forward the ICMP to a specific LAN private IP which you cannot do explicitly. You can set a Private IP to be DMZ which should pass the ICMP through but that may bypass any firewall filters so defeats the object of the exercise. Another bodge could be to use the DOS defense page to defend against ICMP flood attack and set the threshold to 1 packet a second, which may result in a syslog report when a PING arrives.