Well, I made a little progress later on.
I grabbed hold of a kernal ROM disassembly for the startup routines. One of the first things the ROM does is call the cartridge ROM detect routine. At this point, the only RAM-based operation is the JSR instruction, but this only puts an address on the stack, RAM contents have yet to be made use of.
The cartridge detect routine then scans the cartridge area at $A000. If this code is being executed then the BLK5 line (select area $A000 - $BFFF) should go low for a number of times on startup. It doesn't.
This shows that the ROM is not being executed correctly. As an extension to this, the 6502 gets the start-of-execution address from $FFFC - $FFFD. Its quite likely that this isn't being read properly at all, and instead the CPU jumps to some random memory location and begins executing garbage, never touching the startup routine.
My new multimeter should be arriving today (my old one was becoming unreliable), so I can do some further checking of the connections between the kernal ROM and the CPU.
-- Richard