Yep,
Put the NOP generator in. Check that you are getting pulses on the CPU at pin 7.
Check pin 20 of ROMs UD8 and UD9 for signs of low-going pulses.
We then need to monitor the data bus signals (one at a time) close to the CPU. You can't measure directly on the CPU, because these are being forced to a NOP instruction ($EA).
I suggest forcing one data bit at a time. Produce a separate video for each data bit. You will need to adjust the timebase from slow to fast as you are monitoring each data bit. You need to do this so that we can look at the overall picture (a slow timebase) to detail (a fast timebase).
Since you have a dual channel oscilloscope, I would add UD8 pin 20 to the spare channel. Technically, we are only really interested in the data bus when this pin is LOW, or just afterwards.
After this (if we don't observe anything significant) I would suggest socketing (and removing the buffers) E9 and E10. This will isolate the RAM and video RAM from our ROM. Since you have already removed the PIA and VIA devices from their sockets, the only thing on the CPU data bus should be the Kernal and PETTESTER ROMs. If things don't work then, it is either the CPU, the ROMs themselves, the PCB tracking, the soldering, the IC sockets or the address decoder (74154).
If you had one of the ROMulator products you could have moved the ROM and RAM into the ROMulator just leaving the VDU and I/O devices to debug before we move back to the ROM and RAM. We would have (at least) divided the problem into more manageable chunks.
The other thing I was thinking of is the link settings (if your board has links). Remember, from last time, we had a link issue.
Dave