I believe Daniel already has figured out the real issue. i.e. the classes in the .war are isolated (as per spec) and aren't visible to the MDB (which is in a separate EJB deployment even though the same .ear).
But a side issue here is that the exception stacktrace is misleading (unless one goes and looks into the ObjectInputStream code). That stacktrace gives an impression that it is using a wrong module to load the object's class but doesn't give any indication that it's using that as a fallback mechanism because it failed to resolve that on the first attempt while using the (correct) deployment classloader.