3.6MHz appears to be reliable and within the timings for the 512K banked memory card. Going to 7.3MHz it becomes unreliable. I am not entirely sure why as it ought to just about work.
At 5MHz you get 160ns for the entire memory cycle. The slowest memory is the flash ROM (70ns), and the RAM used is 55ns. That sounds like a lot of room but each access also goes through a 74HC670 and a 74HC139 in series which in turn drive the chip select.
By 7.5MHz you get 110ns for the cycle. It almost works.. but not quite. The 74HCT139 can be replaced with a 74AHC(T) part (8ns propagation delay) but the 670 is not it seems available in high speed forms (ALS or AHCT) except as an old Soviet ALS670 equivalent.
Need to see what a 74AHC139 does to it next experiment.