Yet another update, this time with good news.
I finally managed to read the ROMs as an MCM68764/68766 with pulled-up CS1 in my 29B (the 288 still wasn't happy). These EPROMs are the only ones I'm aware of that cram 64kb into a 24pin package, which makes them convenient drop-in replacements for mask programmed ROMs, with the CS2 and CS3 pins neatly lining up with A11 and A12. The catch is that they are very rare these days, and much slower than most ROMs. Thankfully, the VT100's ROMs are an exception, as they are also rated at 450nsec.
I compared the dumps I got with those from Jess Parsons' website, and sure enough, the upper ROM in the address space (0x1800-0x2000) is bad, interestingly only in its lower half. This ROM is indeed ROM4 in the VT100's memory map, so the POST error code was spot on after all!
After checking the options for a viable replacement for all four ROMs, I decided to relinquish one of my precious few 68764s, and burned it with a consolidated 8k image. This EPROM of course expects an active low CS on pin 20. Fortunately, the VT100 has an option jumper W2/W3 on the terminal controller board to negate the CS sense. Swapping the jumper link and dropping the EPROM into one of the four slots did the trick -- another VT100 saved!
TBH, I got lucky here; the only reason this worked with such a slow EPROM is because the VT100 isn't picky about access times. In most other situations, it would be way too slow.
Best regards,
--Roland