I borrowed a logic analyzer, and it did the trick. Here's what I learned:

Paying close attention to the MAX-487 serial drivers, the "Driver Input (DI)" on the MCU and the "Receiver Output (RO)" on the display were inverted. Attempting to parse the inverted-serial data was no good - serial doesn't work like that. It also messed up my baud measurement.

It was inverted because, I now know, phone cabling can be "reversed" (like a crossover or patch ethernet cable), or straight-through. Between patch panels, straight cables are normally used, but to the phone, the cable is usually reversed. Whichever one I've got on hand is the opposite of which the manufacturer intended. Furthermore, RS-485 signals are differential, so crossing the "A" and "B" signals perfectly inverted the receiver output. 

I got halfway through making a crossover RJ-11 monstrosity when it occurred to me - I can test this by jumpering the boards together. I connected MCU-A to Disp-A, and MCU-B to Disp-B with a short wire. Now the displayed data makes a lot more sense! The MCU has (incredibly) kept accurate time and date using just a coin cell for, what, 20 years?

The non-inverted signal was 9600bps - simple. I didn't even have to measure it, as the logic analyzer software's auto-baud blurted it out. I removed the serial driver from the display board, copied a data burst into an arduino sketch and replayed it where the RO line would be, and it worked perfectly.

Now, on to parsing and fuzzing the data!