I thought maybe 48 bytes of ROM were inaccessible for some reason, like the 3870/42, which loses the top 64 bytes of ROM for RAM.

I spent a couple of hours playing with it. I was hopeful it was one of those that just spews out ROM contents in test mode. When the test pin's at VSS, the game plays normally. At VDD, nothing happens; all the output pins are low. Floating, it looks like it's executing random instructions.
The chip has 1 4-bit input port and 2 4-bit I/O ports, so I tied all those low with 1K resistors to see if the chip was using those inputs as the address, but that didn't change anything.

Can I send you the chip (and maybe a couple of Rockwell's that are hassling me, too)? I'd like to get them back after you dump them so I can torch them and map out the bits.