fwiw that code maps at 0xe000

so 0xf8000 - 0xf9ffff is 0xe000 - 0xffff in 6502 memory map which DOES actually give the boot vectors

Code
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

000F9FF0  00 00 00 00 00 00 00 00 00 00 3E E1 00 E0 3E E1  ..........>á.à>á

I'd overlooked them before because I was looking on 0x4000 block boundaries instead

http://mamedev.emulab.it/haze/