Noise on the bus was causing the #CS to (very weakly) toggle repeatedly and quickly. This caused the chip to repeatedly perform back to back read/write operations -- out of specification operation.
I expected something similar to be the cause of the problems I was having, particularly since one of the select signals is just wire-wrapped from one header on the board to a header on the ROM module. While trying to investigate that theory, I made a few revisions to the circuit, and the results seemed to partially support the theory. So, I decided to wire the module so that the second bank was always disabled. Then, figuring that it was also related, I decided to remove one SIMM, to see how much memory was detected.
Those changes led to something quite different: there was more current available, which resulted in a bit of a light show, then this:
Aside from also physically destroying the module, removing that flash IC clarified the explanation: there was still some flux residue under the chip that I hadn't managed to clean, and the flux that I have been using, while very good for soldering, is somewhat conductive (and flammable)! With unrestricted 5V on the select line, right next to a ground pin, and conductive residue still sitting on the edge of the footprint under the chip, you can guess the results (shame on me for not putting a resistor in-line, but it helped provide the explanation in spectacular fashion, which I wouldn't otherwise have had). So, yes, the explanation came with the acrid stench of magic smoke. Fortunately, the GUS seems to have escaped unharmed.
That likely explains the problems I was having with the ROM module all along, and the reasons that removing the module seemed to immediately restore normal operation. Undeterred, I will build another one soon (using different flux!), so that I can test more thoroughly, and am already working on a revised version of the board.