It's probably worthwhile to summarize what hardware aspects I have gleaned thus far.

Port A:
b7  LCD EX
b6  (not bonded on DIP40)
b5  RAM Bank Select 1 (A16)
b4  (not bonded on DIP40)
b3  RAM Bank Select 0 (A15)
b2  ??? 
b1  Low Battery
b0  ??? 

Port D:
b7  (not available with external memory)
b6  (not available with external memory)
b5  LCD data 7
b4  LCD data 6
b3  LCD data 5
b2  LCD data 4
b1  ??? 
b0  ??? 

Port B, C -- (used for external memory address/data bus)

8000 write:  Keyboard columns
8000 read:   Keyboard rows
C000 write:  Keyboard columns

8000 write:  b2 - LCD R/~W
b1 - LCD OC2
b0 - LCD OC1

Inferred Key ScanCodes:
The keyboard scan code is 8-bits, with high nybble being row number, and low nybble being column number.  The firmware largely works with scan codes directly.  This is a bit tricky to figure out the key matrix from software alone.  A few can be figured out because they correlate to prompts indicating what key is expected to be pressed.
0x22    'y'     as per prompt y/n @ EF20
0x5e    '1'     as per prompt 'send speed' @ F084
0x5d    '2'     ...
0x5c    '3'     ...
0x51    '4'     ...
0x56    'Clear File'    as per 'handleKeyScanCode' @ EE08
0x4d    's'     as per change send speed at @ EE14