... bizarre behavior - a list of checkboxes, last selected of which can not be unselected.
There is nothing stopping the user from unselecting all checkboxes, unless you force that situation. You shouldn't force that situation.
Going with the assumption that a confirmation action is required to commit the information, that action simply need not be available unless at least one checkbox is selected. Text instructing the user to have at least one option selected is not something that needs to be shunned.
For example, quite often user can have may roles assigned, but at least one role is obligatory.
If we continue with this example, in addition to possible solution described above...
One solution is to ask two questions:
- what is the user's primary role, giving them a drop down to select from.
- what additional roles do you want to assign to the user, giving them checkboxes.

download bmml source – Wireframes created with Balsamiq Mockups
Now there is always at least one role set, via the drop down.
Another possible solution is to have a minimum role that all users are a part of. Every user is simply part of the "user" group. This group is now hidden from the user and it is always assumed that they have at least a minimum set of privileges because a role is always assigned to them. The user does not have to know the complexity of groups happening in the background.
Checkboxes do not demand at least one be selected in the group. Forcing that condition, by preventing the user from de-selecting the last box, is actually what would be the counter-intuitive active.