It is the rising edge of RD that is used to latch the data into the 8085. The ROM has from the falling edge to rising edge to deliver the data. The decoder is level sensitive not edge, so the rising edge will not only disable the ROM but also latch in the ROM data. That looks like it is working as expected.
The fact the CE is sort of random probably means there is random data in the RAM, it could be heading off to another RAM bank because of this after the IO operations. I just wonder if the missing NiCD is causing some problems. The Model T family is somewhat unique for its day in that it expects the RAM to retain the data between power cycles.
