iptables on Debian Jessie support the --wait option which will wait for lock to be released on xtable if another process is currently has a lock on it. This can also prevent any race conditions.
I received a whonix_firewall failure due to this error; only once that I have noticed, but it would most likely be best form to update the whonix_firewall to use the --wait option
-w, --wait Wait for the xtables lock. To prevent multiple instances of the program from running concurrently, an attempt will be made to obtain an exclusive lock at launch. By default, the program will exit if the lock cannot be obtained. This option will make the program wait until the exclusive lock can be obtained.