Upon further investigation, it seems that the page submits all of the VPN configuration information in one form value called "vpn_conn1".  This value contains each VPN setting in key-value pairs separated by semicolons, which explains why the UI would have validation to prevent semicolons from being entered.  However, to the best of my knowledge, a semicolon is a perfectly valid character in a shared key.  I would hope that there is a way to escape this value, or "quote" the entire PSK entry.  I even tried re-sending the actual POST request outside of the built-in UI to bypass the validation.  This resulted my VPN being listed in the VPN list, but with a truncated key - the semicolon and everything after it weren't there, as if they were part of an unrecognized (and subsequently ignored) parameter.  I then tried replacing the semicolon with %3B, with the same result.  Wrapping the key value in single and double quotes didn't help either.
There really should be no reason why a DIR-330 should be unable to connect to VPNs that use these characters.  Other than this "issue", I really like this router.  I want to make it work!