STM32F4xx bootloader & interrupts
I think I found a missing link myself.

Instead of jumping to the Reset_Handler itself, jumping to the Reset_Handler + 1 helps. This sets the LSB to 1 an gives an indication that it is thumb code. For the IRQ handlers it is documented in the ARM Information Centre.

Most (if not all) jumps in the generated code from C have an LSB 0 of zero (and interrupts still work), I don't understand fully why it is necessary to set the LSB in my case. Perhaps: Normally the jumps are relative (but inside the debugger translated into addresses with an LSB of 0) but the jump to the bootloader is an address which is loaded with a register first and than jumped too.