Just tested EOB1 with VGA+Adlib+Mouse and 640KB of RAM, it runs.
It seems like a bug of your emulator.

If you return other than 0xFF for the high memory, do you get a different PC address on the crash?

If I look at the memory detection code at http://forum.osdev.org/viewtopic.php?t=17039 it looks like the last value read/written to existant&non-existant memory is read when reading unimplemented memory? This applies to 32-bits read. What about 16/8 bits or interleaved 8/16/32 bit reads/writes? Do 16/8 bits access leave the upper 24/16 bits unmodified? Or are they cleared?

I've modified my MMU to save the last valid RAM byte (up to 32-bit), saving the low 8/16/32 bits of the last valid read or (in)valid written data.

The NMI being called when accessing the memory hole (640K+ to 1M) seems to cause the software to crash (either FFFF:FFFF or somewhere in the middle of RAM, depending on the last read/written value (e.g. the value left on the data bus)). Removing the NMI on unmapped RAM seems to fix the problem.

Of course the question now is: does the NMI need to be activated on unmapped memory I/O(RAM which doesn't exist) or only when a memory error occurs(data in RAM after write doesn't match the data that has been written)?

NMIs are hardware errors. Reading or writing to unmapped memory should not throw a NMI. Emulators, being perfect machines, never throw NMIs (unless you want to emulate a broken PC...)

Except stuff like SVGA NMI used for CGA/MDA compatibility?

NMIs can also be used for things like debugging cards or, as you said, some SVGA card, but I'm pretty sure that if you access unmapped memory no NMI will be generated.
But I'm ready to be proven wrong, I'm no hardware expert, just another emulator writer 😀