Does this all mean that the code would be now safe?
Your test confirms that the alternative palette buffer address is correct. The two buffers can now be compared when the palette appears corrupt.
What is next on this path?
You could make some memory dumps on 101a - when the overlay is OK and when the palette is corrupted.
Perhaps reyalp will post a better binary dumper, in the meantime you can use the following code snippets in chdkptp:
Execute this once (to register the necessary event procedures)
=return call_event_proc("System.Create")
Then execute the following long line - it will dump the first 3MB RAM into a file named dump.bin in the root of the card.
=fd=call_event_proc("Open","A/dump.bin",0x101,0x1ff);call_event_proc("Write",fd,0x1900,0x2FE700);call_event_proc("Close",fd); return fd
Now, either change the file name or download the file after this, it will be overwritten on each execution.