Firmware improvements
I got this great info on the USB IR Toy via email, I wanted to share it with everyone:
I haven't tested the functionality of the USB IR Toy yet, but I did plug it in to look at the USB Descriptors. They indicate that the device is self-powered when it's really bus-powered. I suppose there really isn't any extreme harm, since both the self-powered and low-power bus-powered functions are limited to 100 mA, but it would seem prudent to correct this.
I looked at the source and see that this is because the CDC usb_descriptors.c starts with this value as default. I think you should remove the _SELF from future builds. Certainly not a critical priority, though.
Also, there's no need to pad the Product String out to 25 characters. You can simply change the string array size to 18, or less if you want a shorter string - e.g. "USBIRtoy" would only need 8. On the other hand, leaving the trailing spaces does allow hackers to easily change the text without recompiling, and that has its benefits. I note that you did change the Vendor to 23 characters, so I guess you already know how this part of the Microchip USB Stack works.
One other comment is that the Diolan bootloader seems a bit overkill, at least their XTEA encoder/decoder. I don't quite see the need to encrypt open source firmware. Then again, I've tried working with various bootloaders for the PIC, and none of them are perfect, not even the one I wrote myself. Since I have the PICkit2 and www.pic16.com clone, I'll just ignore the bootloader.