I'd do the two-sets of invitations.
Of course you could wait till the boys' parents reply, but then you could end up waiting for another reply - perhaps "oh, I think he might have a soccer game the next morning, I'll have to call back to let you know". I'm all for simplicity...
I agree with this. And also, when I plan events for my family, I want all the info. There is often a delicate balance, and finding out *later* that there's yet another component, especially something as imapctful on my schedule as a sleepover, I'd be sort of pissed.
However, I don't think the parents of the girls will expect the girls to stay on a sleepover. So don't worry too much about hiding the sleepover--just send them their own invites.
And coach your son on how to handle it--that he and his friend should simply not mention the sleepover in front of the girls, but if it does come up, he can say, "I can't have girls at the sleepover. But I really want them to come for the other fun stuff!"
(Personally, at 9 is when I would just about be ready to end co-ed sleepovers, but I might still send my daughter at that age. 10, maybe not; younger, definitely. And yes, I know I'm weird.)