Ok, now I've tested swapping the cpu ports. The most annoying thing with that is that the mac addresses are also swapped, so computers on the inside deems that the connection has changed. Not serious, just annoying.
But the results are clear. With this setup, the query frames still end up on eth0 (which is now lan), even with igmp snooping enabled globally on all ports. eth1 ends up being isolated (like it should). In other words, this means that eth0 for some reason is special. I did revert back to the original setting after testing, though.
But I can confirm that with the ports swapped, IGMP snooping on the LAN side would most likely work as it should, since the IGMP queries then would end up where they are needed.
But the big question still remains: What is so special about eth0 as to cause it to be a magnet for IGMP queries? I'd rather have the default setup for WAN/LAN, as that is what every build usually has.