I found the culprit: It's the Debian deprecated.patch, which I attach below, in case you are interested.
This means it's a Debian packaging bug. Debian applies this deprecated.patch during build, thereby apparently making fvwm incompatible with the X xerver running inside vnc. In retrospect, I should have earlier tried to confirm whether the problem is present at all in the upstream fvwm version. However, I was under the wrong impression that Debian distributes an almost unmodified fvwm (the opposite is true - there are 12 Debian patches). Further, also the email from Raphael in March on the fvwm list gave me the impression somebody has checked this with upstream fvwm. Bye, Hendrik This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.