The NotSerializableException was valid as the target was not serializable. The only question is why the deserialization of the proxy is not restoring the underlying bean properties correctly.
The problem was that the call to KernelControllerContextAware.setControllerContext() was happening as part of the InstantiateAction, i.e. before the bean was configured.
In other words, when it was serialized/bound into jndi the state had not been set yet.
I have moved the KernelControllerContextAware.set/unsetControllerContext() calls to the ConfigureAction for now, but we do need something a bit more fine-grained for these life-cycle aspects.