Can the 2860 do inter-vlan routing with explicit rules i.e. vlan 1 can reach vlan 2 and 3 but vlan 3 cannot reach vlan 2? Also, can the firewall block certain ports between vlans?

Am I better off using an extra Cisco router for that?

Yes it can - you would use the table in the VLAN section and then create polices in the firewall to define your specifics

The second set of options are greyed out for me, despite creating three lans.

A reboot has made the options appear.

Thanks!