Here's the fix. Go get v24-TNG svn10431 over at DD-WRT's site. It's under downloads/others/eko/V24_TNG/svn10431
Remember to reset to router defaults before and after you flash, from the main menu, not from the flashing menu. After I flashed my router it was still the old version (confusing, yes). I reset to router defaults from the main menu and then it showed the new version. Weird. But yes, UPnP is working now!