Oh, I see the problem. Set $2001 to zero before you do any writing to VRAM. Then turn the screen on after you've cleared $2005 and $2006. That should fix it.

The program is modifying the VRAM address ($2006) at the same time the PPU is using it. That's why VRAM can only be updated during vblank, or when the sprites+bg are disabled.