I've confirmed from the UPD78C10 manual that this is a legit bug in MAME's upd7810 core, the number of bytes for LDAX opcodes 29-2f and STAX opcodes 39-3f are wrong.
This might explain random bugs in other devices using the upd78(c)10 cpu core in MAME.