SHA256 has no advantages over SHA1 in the context of PBKDF2. Regardless, I am in the process of switching to scrypt which is a stronger algorithm. As to choosing the number of iterations - users really shouldn't be bothered with choosing a secure value. Other password managers typically allow choosing it because their defaults aren't safe to use.