"Forever" is a long time. At some point in the future (maybe in few decades, maybe in a few centuries), quantum computing will effectively "break" elliptic curve multiplication. At this point, any "lost coins" held in an address with a known public key become hackable and therefore can re-enter circulation. This will include all very early coins stored on "Pay to Pubkey" addresses prior to the implementation of "Pay to Pubkey Hash". It will also include any inactive coins stored on addresses which have made an outgoing transaction, as the public key is revealed when a transaction is made. (Presumably at some point before that happens we will fork to quantum resistant addresses, and all coins in active use will be moved to these addresses, but a lot of old inactive coins could suddenly become active again).
Because of this, it is premature to call any coins "lost" unless they have been provably lost.
If a private key must be 2^256 and cannot intervene that (like more than 2^256), then I call some coins lost forever. Yes, the addresses like satoshi's ones may be brute forced in the future with quantum computers, but what about this kind of addresses?
1xxxxxxxxxxxxxxxxxxxxxxxxxy1kmdGrThere is no 2^256 private key that generated that address. Thus, there is no proof that there is a private key that generates that address. As I said, only if we can't intervene that range of numbers: (1, 2^256). Otherwise, as far as I know about quantum computing, there won't be any hash encryption that can stand on its way. Although, if no private keys within that range can fit that burning address, then they are burnt for good.