> but the kernel that results won't boot (too big at 2568202?)

you need to turn some kernel options off so that you can build the
firewall features, or strip the kernel.

you might look at commenting out items like NFS, NFSSERVER, QUOTA,
SOFTDEP, PCIVERBOSE, SCSIVERBOSE, ahc* scsibus*, sd*, st* before resorting
to stripping a kernel.

these were all included by default in the GENERIC kernel