Hallo Pete,

additionally to recommendations given by Lee I want to focuse another possible cause: Absence of reset controller with brown-out detection. When Vcc shows undervoltage, microcontroller can run ill in such a manner, that erroneously changing of internal flash code memory can result.

So, despite what's proposed in actual datasheet, never use simple RC-reset circuit, but only reset controller with brown-out detection!

Kai