Sooo sorry to bother y’all. The cause of this had nothing to do with the upgrade to WP 4.0.1, so you admin people can feel free to delete this thread if you like.
Turns out I ran an unrelated script on my server that changed the “max_post_size” parameter in the PHP.INI file from a very large value (“8M” in my case) to a very small one (“351”). My system log gave me the clue with this error message:
PHP Warning: Unknown: POST Content-Length of 1041 bytes exceeds the limit of 351 bytes in Unknown on line 0, referer: http://www.example.com/wp-admin/edit.php
That meant that some very short commands (like logins and toggle-setting) would work, while longer commands (like adding menus or updating posts) would fail.
Changing PHP.INI back to the larger value fixed the problem.