When I bring a number of change sets over from one org to another I find that only the user permissions are contained within the XML. How can I ensure the object and field permissions metadata is included as well?
You need to include the objects, classes etc in the change set as well. This is the trigger for salesforce to include the object permissions, field level security, record type perms etc in the profile or perm sets. The rub however, is that this will deploy your objects etc even when you have don't want to do that. So, be very careful about doing this using change sets. You can do the same using other tools like Force.com IDE, ANT. These are developer focused tools. So, proceed appropriately.
There are vendors that publish tools to accomplish this stuff without too much difficulty, like the company I work for, DreamFactory.