[exim] testing filter seems to forbid most features

I am attempting to test a user filter, but it seems that most of the
features that can be forbidden are. I've gotten errors both from
exists and lookup/lsearch. For example, with

# Exim filter
if $sender_address matches  "ab" then 
    deliver ross+${lookup{users@???} lsearch {$home/knownLists}{$value}}

Filter error: unknown filtering command "lsearch" near line 3 of
filter file

My configuration appears seems quite permissive (snippet at bottom).

What am I missing?

The is with Exim 4.63 packaged for Debian.

----------------- configuration snippet ---------------------------------
userforward:
  debug_print = "R: userforward for $local_part@$domain"
  driver = redirect
  domains = +local_domains
  check_local_user
  file = $home/.forward
  require_files = $local_part:$home/.forward
  no_verify
  no_expn
  check_ancestor
  allow_filter
  forbid_smtp_code = true
  directory_transport = address_directory
  file_transport = address_file
  pipe_transport = address_pipe
  reply_transport = address_reply
  skip_syntax_errors
  syntax_errors_to = real-$local_part@$domain
  syntax_errors_text = \
    This is an automatically generated message. An error has\n\
    etc...