Fixed it, finally! For whatever reason, I could only fix it by manually stopping the event log service, then copying the files as above (to preserve the permissions/ACLs), then starting the service ...