Hi,

A solution may be that the boot code looking for in flash (at a specific address) a signature or a checksum to be sure that a code is present in flash or NV-Ram... If it found, toggle a Port pin or a dummy read or wirte at a specific address, then a glue logic (maybe a PAL) reset the µC and change the way of WR/RD PSEN signals (PSEN is lead to Flash and RD/WR lead to SRAM)...

Do you have a PAL programmer ?