This technique you described is exactly what I was proposing in the IIci ROM hack thread. It's very sneaky. I think it would work perfectly, but as you said there are speed constraints. If you wire something to the PDS, I believe there is a signal that allows you to acknowledge when you have finally put some data onto the bus after a request (correct me if I'm wrong on this). With that technique, I think a microcontroller could handle it. If you go through the ROM SIMM socket, though, the IIci's glue logic is creating that acknowledge signal and there's no way to override it that I know of. It creates a hard time constraint that you *have* to meet.
GttMFH says the IIci has a ROM access rate of 20 MB/sec, and the IIfx has a ROM access rate of 64 MB/sec. That's a great number to have but it doesn't really specify how quickly a chip has to reply with data after the output enable pin goes low--it just specifies the entire cycle time. Either way, my calculation puts the cycle time in the low hundreds of nanoseconds (20 MB/sec --> 20971520 MHz, but four bytes are read in parallel on each access, so really 5242880 MHz --> ~191 nS). So I think the actual time until data is good would have to be quicker than that. Unless my calculation is wrong and they mean 20 MB/sec per chip, in which case it would have to be even *faster*.
I just don't know if a microcontroller can respond that quickly. *Maybe* with an interrupt handler that is *never* disabled and *always* responds quickly, along with software on the Mac side that constantly polls until the data is ready?
Or, I hate to be the guy who says it, an FPGA? ;-) (You'd still need the polling logic in the software on the Mac side)