I think the reason I need to unplug the keyboard ROM is so I can get access to the KBD' signal. This is so that the microcontroller can buffer keystrokes and output them one at a time as the motherboard CPU requests them. It turns out that a card in slot 1 of a IIe can disable the onboard keyboard by deasserting ENKBD' (Slot 1 pin 35) and then watch for accesses to $C000 and $C010.