Is form_state going to persist the user data for me between form loads, or is there a better method? ... You can safely use the form_state array to store your temporary data, but remember that the form cache has only 6 hours to live.
The form cache only stores data for a single form submission attempt, bound to form_build_id. Each time the form is built from scratch in a GET request, a new form_build_id is generated, and the form may be cached, but it is not supposed to re-display any previously submitted values that were cached for a different form_build_id. Your shopping cart use-case sounds like $_SESSION or a dedicated table keyed by session ID and uid to me. Also not sure why you want to reinvent the wheel -- doesn't Ubercart or eCommerce or anything else in contrib contain a ready Cart module already? sun