Cool =) and now I wonder if it's the same on 1-bit mode.

2 other cases you can test:
- after setting the complete address, then reading a byte, then setting an incomplete address, what is the address? ... what a stupidly worded question :P lemme redo it like this

LA=$F, LA=$F, LA=0, LA=0, LA=0
READ = dummy
READ = dummy
READ = from where? $FA? or did the address get zeroed and it reads from $0A?

The other thing: The datasheet says that READ BRANCH can only be used on single-chip configurations. Is this true? This implies that the upper bits of the address are zeroed after setting indirect address. It's testable by trying this on one of the Speak&Spell cartridges, which has a CS(upper 4 bits of address) of not-0. So, first set direct-address to a valid one, then set indirect address.