Interesting discussion. A few things to add/reiterate:

(1) I think for at least some platforms (Data East I think), there may be custom unofficial test ROMs that cycle more predictably through the address lines. At least with the Data East MPU, the ROMs sit in the upper 48K which should be safe to traverse and still excercise all 16 address lines.

(2) Because of the nature of memory-mapped I/O, you would want to be careful if you wrote your own code to cycle address / data lines. Depending on the circuit design, a lot of memory-mapped I/O is read/write line agnostic and treats reads and writes identically. The danger is energizing a coil accidentally and not turning it off in time. You'd also have to make sure you tickled the watchdog circuit often enough.