You can simplify your circuit by replacing the 1k ferrite + 330 ohm resistor by simply a 1.3k resistor (or of course whatever value nearby; these are arbitrary anyway). What the ferrite practically does, is to make the transition band of your filter steeper; so you get faster response for lowish frequencies (defined by the 330R) while still filtering very high-frequency noise better (defined by 1330R total). Now, you probably don't
need this feature, and can just filter
everything defined by that 1330R, or whatever you want to use. For filtering noise, it's as good as your ferrite solution, just reacts slower. How slowly? Well, the RC time constant is quite close to the CMOS thresholds, so let's say it's t = R*C = 130 us. I
think this is good enough for mechanical switches

. You may want to make it even slower to aid in debouncing. But beware,
massively big capacitors start to have increased inductance (due to their physical dimensions) and hence, start to be less effective on really hi-frequency filtering.
An RC filter with a big enough capacitor is an
excellent ESD protection, and it's simple. Keep the capacitor at the trace that goes from input to the IO pin; if it's branched away far, it'll have extra inductance which prevents it from filtering quick spikes. If you place the capacitor right next to the IO pin, and have a good ground plane right there, the IO pin is going to see the same smooth voltage as the capacitor.
The ESD
charge has to go into the capacitor, and most of the
energy is lost in the resistor; rest is stored in the capacitor. If the values are sufficiently high, the capacitor voltage (directly dependent on the amount of charge stored to it) doesn't rise much at all, even from a severe ESD shock. I would ballpark from experience that 1k + 100n is definitely good. (Similarly, large power MOSFETs with equivalent gate capacitance around 10n and more are not very suspectible to ESD failures.)
If you want to add extra robustness to the inputs, using a schmitt trigger buffer (look at inverters as well, they may be cheaper or better and it's only about flipping the bit in software) can be a good idea; especially if you don't have time in software to do debouncing, or need to use the switches as direct interrupt signals. A schmitt trigger will have larger input hysteresis band than your normal MCU input; but even the normal input pin hysteresis is probably good enough. If you use such a buffer, you may want to look if you find a buffer with better ESD spec than your controller IO does, however, with proper RC filter in place, it shouldn't matter much.