Check e.g. Visual 6502 - http://www.visual6502.org/JSSim/index.html
It turned out to be a dumb circuit design around the Z80's NMI. I don't remember the details now, but there is a circuit that is like a low voltage (brownout) detector that triggers NMI, where the firmware branches to a loop. The idea was likely this: to prevent trashing the settings if that happened during a write cycle (setting being stored). Anyway, this NMI would happen on startup, during the voltage ramp-up.
I deduced it purely from reading the schematics that, hey, this circuit could activate NMI close to power up.
The fix was to just cut the trace to the NMI line with a sharp instrument; presto, no more random lockups on power on.
The kicker was having debugged all this, I found a 1989 dated document from Ada which confirmed everything and recommended the same fix. I think had that document all along but it was hard to understand what it was getting at. and take note, if you didn't already understand the problem.