So here's one great thing about collaboration rather than working alone: other people think of things that you don't. I had always naively assumed that all accesses to cartridge memory would look as described in the 68000 datasheet, and therefore (ignoring bank-switch issues) if one game works, all of them will work.
Uh-oh. Not so. Apparently the Megadrive does DMA accesses to the cartridge address space, and probably with tighter memory timing requirements. I read somewhere that Street Fighter 2 does a lot of DMA from cart memory, so I tried it on my UMDKv2 prototype, and this is the result:

Can anyone who knows Megadrive programming decipher what's going on here? It only happens on stuff which animates, not static backgrounds. The game basically works and is playable, but with this corruption of the sprite data. It doesn't look like random corruption though, it looks more like an off-by-one error in the sprite data addressing or something. TBH I don't know enough about the Megadrive internals to comment so I'm just guessing.
At least now I can set up some test logic in the FPGA to observe what's going on and hopefully solve the problem, but I thought I'd post it here just in case anyone has any hints.