I just looked into the source. You are right. The injection is done AFTER and not BEFORE RESTORE_VIEW. There is a comment in the source saying:
Parameter validation and injection must occur after RESTORE_VIEW in order to participate in faces-navigation.
Is there any reason you are using things like c:forEach and c:if? It is not very common to use these because they are evaluated during the construction of the component tree. Why don’t you use things like the rendered attribute of standard JSF components instead?
See this blog post for some details on the differences: