I've already tried removing both boards, and it didn't help.
I just noticed that there is a second flash IC. From probing the chip enable pins, it seems like the vast majority of the reads the CPU does are from that chip. The CPU seems to get stuck at a specific address on this chip. Address bits A7 and up appear to be constant (with the exception of a short pulse caused by the address data having to be shifted into flip flops). The CPU seems to do some sort of counting for the lower bits (A0 - A6). For example, the lowest address bit cycles between 0 and 1, and the highest address bit is constant at 1. This might be because I don't have the +/- 12 volts connected to the motherboard yet. I'll try it again and see with those rails connected.
Board