OK, I've got the palette-writing part of it working. But I had to reduce the VRAM I/O to one byte per scanline. So it is full-screen. The timing looks OK on Nintendulator, but it's royally screwed on Nestoptia (and NESten).

Something must be wrong with my 'VRAM address repair table', though. The tiles for the test text I put on the screen are screwed up. I don't understand what's going wrong, I've seen other demos and games do stuff with $2006 and it works.

I'm trying to display my background upside down. :)
But it looks like it's looping-back or something, every 4 lines. The text should read: "TEH F.A.U. SCREEN TEST!!1" (sic).
See what I mean?
http://mywebpages.comcast.net/memblers/fau.nes
http://mywebpages.comcast.net/memblers/fau.s

In the source you can see 2 tables, vram_addr_hi and vram_addr_lo, that are used as 'repair tables' for the VRAM address before the end of every hblank. The current scanline is used to index into them. I made the tables by hand, maybe I screwed them up, but they look OK to me. So I'm kinda stumped at the moment.