Is there an existing AE protocol with forward secrecy for embedded devices?
I've finally found a solution - some variants of key ratcheting, e.g. the one used in SCIMP, provide perfect forward secrecy assuming an initial shared secret is established without any asymmetric crypto, and they don't even require a secure random number generator on any of the endpoints!

In this case all we need for an authenticated and encrypted protocol with perfect forward secrecy a symmetric cypher, an authenticated encryption mode for said cypher (e.g. EAX) and a hash. We can even ditch the RNG on the embedded device.

This is not a complete protocol, but gets us most of the way to one, and it's dramatically simpler both in the implementation and the number of required primitives than TLS.

The hard part is proper handling of message losses on the wire without opening up to downgrade attacks, but it's easier than correct custom implementations of asymmetric crypto.

Ironically, nobody I asked could tell me about using such key ratcheting for perfect forward secrecy. Our team has come up with the scheme on its own and only after that I've found it in literature.