I finally dug into why iptables’ LOG option floods /dev/console. Of course it also logs to /var/log/messages, but that’s what I want.
The trick seems to be to tell klogd to not regurgitate everything to the console.
In CentOS/Fedora/etc:
vi /etc/sysconfig/syslog and add these to the "-c 1" to KLOGD_OPTIONS
My line now reads: KLOGD_OPTIONS="-x -c 1"