I found a video that shows Entex Pacman 2 demo mode, and can confirm that it's wrong in MESS. I tried changing a few things like initial RAM contents and register values, but the only thing that changes demo mode behaviour is opcode/interrupt timing.

It means timer interrupts happen 1 or 2 cycles too late/too early, and/or one of the opcodes takes more cycles than stated in Hitachi docs.