Could it have anything to do with the bootloader?
it would be provable , the board has access to a icsp with a modified cable you could overwrite the loader easily enough.
you can download the loader from mikroe to replace it afterwards
since you have repeatable example to offer charles it could not hurt to ask his advice.
the 108 cell in buffer is pretty close to access bank sfr range , i wonder if there is a stray access ram bit being set in an instruction
that could all sorts of bad stuff.
have / can you re-verify code ?
can you blank a code range and verify it is blank. [bootloaders are they worth the doubts?]