I agree with tylerl's answer above. However, reading the comments under that answer, there's contention where there shouldn't be... which is caused by confusion I hope to clear up. And then explain why I think two firewalls are not better than one for the question asked.
Point of contention: can a firewall be exploited? One group says no, while others say yes.
Here's the important question to ask: can you administer the firewall on the network?
For argument's sake, I setup a Linux box as a firewall to manage traffic between the internet and my home network (wired + wi-fi). I also configure it such that the firewall machine is NOT on the network, so the only way to make changes to the firewall rules is to physically logon to the machine.
In this administration un-networked configuration it is impossible to exploit my firewall from the internet or from my home network. To exploit it you would first need to break into my house and access the machine physically.
As pointed out by several people, the firewall aspect is simply a barricade that decides what traffic gets let in - there's nothing exploitable about that part.
But if I reconfigured my setup so the firewall machine so it is also connected to the same home network and made accessible via SSH, then I will be taking a risk. Any attacker that gets into my home network (through whatever ports that were open from the firewall) could then utilize some SSH exploit to get in the firewall machine.
Let's say that our first firewall has some vulnerability and a malicious person is able to exploit it.
This implies your first firewall box was connected to a network accessible to attacker, and there was some accessible service like SSH to exploit.
If there's a second firewall after it, he/she should be able to stop the attack, right?
Depends - is your second firewall box also connected to a network accessible to the attacker? If so, then sure it could be exploited by a savvy attacker as well.
In reality I would not expect seasoned admins to make such rookie mistakes.