OK, in the end I went with:

if ($http_user_agent !~ "Amazon CloudFront") {
rewrite ^/(.*).(png|gif|jpg) http://abc.cloudfront.net/$1.$2
}

which seems to do the trick. Seems like there should be a better way of doing what must be quite a common form of rewrite though? (Or is this the fast alternative to Apache's REWRITE_COND?)