I'm sorry, I think my continuity tester was on the fritz. I switched to a different one that has an audible indicator and I found much more connections. All data and address bits are connected directly between the ROM SIMM slot and the onboard ROM. trag, you were right.

I have extensively tested all connections and all connections are continuous between onboard ROM and the ROM SIMM slot, including !CS and selectively !OE, depending on if the jumper is installed or not. There is an ohm or two of resistance when measuring !OE from the SIMM slot to the onboard ROM, so maybe i'll have a second look at that. But really, that's to be expected when going halfway across the board and weaving from side to side like it does.

!OE is always connected to the SIMM slot, but removing the jumper disconnects !OE from onboard ROM. There is no inverting logic involved.

I uploaded my findings to the wiki:

http://68kmla.org/wiki/Macintosh_IIci_RAM_and_ROM_Pathways

Because I've verified every single connection between the ROM SIMM slot and the onboard ROMs, combined with the fact that a ROM SIMM works and the onboard ROM does not, I think the only conclusion to be made at this point is that the onboard ROM itself is the problem.