Anyway, I assume your core runs RunPPU() on PPU reads/writes in order to work properly, doesn't it?

Yep. The final call to RunPPU in the above pasted code is just to make sure the PPU completed the full frame. But yeah... on PPU related register writes/reads, RunPPU is called to catch up the PPU to the current CPU timestamp (so that changes can take effect even midscanline if needed).

This includes not only $2xxx registers, but $4014 as well as mapper controlled CHR swapping and mirroring mode switching -- anything that could alter the PPU or what's being drawn.

Have you seen any side-effects while running things like this (I mean, any game behaving in a weird manner)?

Still having problems with Battletoads (level 2 locks up)... but everything else I've tried runs fantastic.

And the last one, could you explain in detail what that "NMI tweak" consists on? I haven't seen that anywhere..

Here's the post by BT which sort of explains it:

http://nesdev.parodius.com/cgi-bin/wwwthreads/showpost.pl?Board=NESemdev&Number=878&Search=true&Forum=All_Forums&Words=NMI%25202002&Match=And&Searchpage=0&Limit=25&Old=allposts

Basically, if the game runs a wait for VBlank loop like:

loop:
 LDA $2002
 BPL loop

problems come up if the game does that while NMIs are enabled. If you turn on the VBlank flag in 2002 at the same time you execute NMI (which is what you're supposed to do), these games will run their NMI code, and usually clear the VBlank flag in the process. When the NMI returns, the flag is off, and so the game never breaks out of its 2002 loop.

At the end of BT's post, he mentions the option of raising the VBlank flag, running the CPU for X cycles, then executing NMI (so that the 2002 loop will have the opportunity to acknowledge the VBlank flag before the NMI trips). However when I implimented this... it ended up breaking Q's scanline demo (and even some games, if I remember right). So I developed the tweak I mentioned before: NMI is still triggered at the same time as the VBlank flag is set... but if it occurs on a 2002 read, status gets pushed with the N flag set.

Like I mentioned before... Baseball Stars (MMC1) is the token game that gave me this trouble... so it might be one you want to check out for testing purposes. Before I implimented the tweak, all I got was a black screen.