When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?
Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, Consider the case of $2^{256}$ iterations using SHA-256.
When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?
No.
There is a limit above which you gain no security, but it isn't practical. It's on the order of $2^{128}$ iterations for PBKDF2-HMAC-SHA-2, or $2^{80}$ if you use SHA-1 as the HMAC hash. For an explanation, see the questions mikeazo linked in the comments.
However, due to the structure of PBKDF2 those collisions in the iterated hash likely don't undo the previous iterations, they only add to them (XOR). So the fact that you get collisions in the iterated function does put a limit on how much security you can gain from a high iteration count, since an attacker could stop iterating if they notice a collision. Nevertheless, they need to get that far and the ultimate hash is probably still different from all the other passwords, so that doesn't mean those extra iterations make it weaker.
Cycles, which you would notice about the same time, can technically "undo" previous iterations, but the unique iterations before the cycle begins are still strong, and the expected number of those is also close to $2^{128}$ for a 256-bit hash.
