I think the accepted wisdom here is that /WE should be qualified by phi2, but /CS should not be. The way you do it, you squeeze the entire RAM operation into one half of a processor cycle.

That's the other thing I've had in the back of my mind; shouldn't /WE be driven from /RWB?

EDIT: Scratch what I just said; was thinking of /WE for some reason. I'd think that it should be driven the same way as /WE but without the phi2 part?

EDIT2: Actually I don't know what I'm talking about right now lol; my brain just got twisted.
So, /WE should be qualified by phi2 but not /CS? Wouldn't that lead to both the CPU and the RAM trying to drive the bus simultaneously?

EDIT3: Is it wrong to be using PHI2O ("PHI2C") rather than PHI2? i.e. I'm using the output from the CPU rather than from the clock directly.

I just checked against the "6502 Primer", and it looks like I may be wrong about what should be qualified by phi2; see http://wilsonminesco.com/6502primer/addr_decoding.html

There's more than one way it can be done. You just have to make sure you don't write to RAM before the address is valid and stable. You can either just not select the RAM until phase 2 rises, or, if it's really slow RAM and you need the extra setup time, you can select it directly from the address decoding but keep its WR\ input false (ie, high) until phase 2 rises. SRAM is available in much faster speeds than anything else you'll probably put on the bus anyway though, so you probably don't need the extra time afforded by the second method.

The 6502 does not drive the bus during the phase-2-low period; so you don't have to be concerned with bus contention. Even when the 6502 does a store, the data are only guaranteed to become valid some time (tMDS) after phase 2 rises; so if the RAM is putting out data until phase 2 rises, driving its WR\ input low should end that before the '02 starts driving the data bus. As for hold time after the end of the write, bus capacitance will hold the data for a surprisingly long time when nothing is driving the bus—not just nanoseconds, not just microseconds, but even milliseconds, according to my experiments. (Actually, I tripped across that fact accidentally, and although I observed the milliseconds part, I did not go further to see just how long I could take it.)

I tried looking at your .pdf schematic, and all I get is eight totally bank pages.

I'd suggest doing something visible in the ISR too. That'll tell you that you arrived.

Do you already know that you can JSR and RTS? The memory activity will be similar.

By any chance does anything in your ISR write to the stack?

Do you have an NMI triggering during a regular interrupt?

Shotgunning ideas based on mistakes I made on my machine.

What do you find if you look a few bytes above and below that return address? Is the correct address in there somewhere? (which would indicate you have something in the ISR that's getting the stack out of balance)