Using set_input_line from unmapped memory handler to trigger a bus error in the CPU isn't good enough -- it's async and bus errors can happen at insn fetch time. Worked around this for now (moved bus error tracking to machine from cpu) and some more tests are passing.
I ran into a similar problem while working on the gameboy driver. It should eventually be fixed once a cpu core becomes sub-cycle accurate. I worked around this by making the execute_set_input method public and calling that directly as well from the driver code.
It is still a hack but at least it prevents code duplication.