The 65C816 also signals whenever it's reading the address of an interrupt vector, so you can swap in a different address for the interrupt handler instead of reading the vector from ROM/RAM as usual.
Basically I want to implement from the ARM side an MMU that can emulate the complex bank-switched RAM, ROM, and I/O address space of an Apple IIGS, as well as provide a slightly nicer native mode with memory protection and multitasking, but nothing that won't fit in 8MB RAM and ~20MB of eMMC / SD.