I realised as soon as I asked this that there are iptables-save and iptables-restore. However I'm not sure at this point how that would work. I'll post it as an answer but I think the real solution is going to be a bit more complicated.
One could use iptables-save which prints the currently loaded chains to stdout. You can also use the -t switch to specify user defined chains. So you could output each chain to a file one by one and version control those. However I can't see an easy way of reloading chains one-by-one as the equivalent iptables-restore doesn't have the an equivalent switch (-t means test instead).
The other limitation of this method I noticed was there is no way to save the built-in chains individually (i.e. INPUT, OUTPUT, and FORWARD). The only way to get those out is by not using the -t switch and dumping everything.
It would need some scripting to wrap this all up into something one could easily save and reload.