Fixed it! So far...

To clarify, no CONFIG commands were used in the code. All the registers were configured with #define statements.
I forgot to mention that the code uses a bunch of assembly macros, all collected in a separate PBP file. That appeared to be the source of the instructions that were being overwritten.

I looked into the ASM file that was generated by the compiler and saw that it was about 24 kb. I changed the RESET_ORG value to be just a bit beyond that just to see what would happen (thinking that this would tell the compiler to start writing instructions after 24 kb of memory) and it worked! No more overwritten addresses!

HOWEVER, I have not determined if the code still works as intended on the device. That'll be the topic of another thread.