A 28C series EEPROM can be used as replacement for an equally-sized 27C series EEPROM without any issues. A 28C256, or Winbonds 27E257 (later called 27C257) is a suitable replacement for a classic 27C256. The 28C128 has one address pin less than the 27C256. That's pin 27. On the 27C256, that pin is A14. On the 28C128, this pin is /PGM. This means if the card tries to access the low half of the 27C256 (A14 = low), it will enable "programming mode". The Microchip datasheet for the 27C128 I found doesn't specify what happens if you apply a programming pulse without applying 13V programming voltage to pin 1. Likely the chip will not be modified because there is no sufficient voltage for programming, but this is undefined. I couldn't find a 28C128 datasheet, but the same should apply.
So to use a 16KB 28C128-like EEPROM on a device that expects a (up to) 32K EPROM, do not insert pin 27 into the socket, but just tie it to pin 28 (possibly using a pull-up resistor instead of a direct connections, so the device stays programmable).