Sorry if this is a dumb idea, I don't know much about what's going on. I know that on the IIci there's a jumper you take off to use the ROM SIMM slot (at least, I think that's how it works.) While the jumper is in place and the computer is on, is it possible to access the ROM SIMM slot using some sort of utility? If so, would it be possible to make a ROM SIMM that you can flash from the OS? Have a utility where you select a sound and maybe a couple icons for the startup process, it flashes the ROM, you then shut down, pull the jumper, then boot with modified ROM.
What jt said, although I also liked what one of my teachers used to say. "The only dumb question is the one to which you already know the answer."
If you leave the jumper on, and you insert a ROM SIMM, the computer will not boot up. So, in practice, no, you could not access the ROM SIMM with a utility while the jumper is in place, because you would never be able to boot the computer.
However, if you have a bootable ROM SIMM, it should be possible to build a ROM SIMM which is programmable in place. There are pins in the socket for WE_ and maybe for Vpp as well, but I have no idea how one would control the Vpp pin from the Mac OS. Apple built some programmable ROM SIMMs for other, later machines. At least, they have all the traces in place needed for programmability and those traces serve no other discernible purpose.
Of course, if something interrupted the process, you'd then have a useless SIMM until you could reprogram it some other way.
I'm blanking on the user's name now, but one of the fellows here traced all this stuff out. He put his results in the Wiki. Basically, that jumper controls whether the Chip Enable pins get a Low signal. Chip Enable is Active-Low. Which means that if it is high, the chip is disabled.
So, if you pull that jumper, the Chip Enable pins on the soldered-down ROM chips all go high and the soldered down ROM is disabled. The jumper doesn't affect the socket at all.
With the jumper installed, install a ROM in the socket and now you have two different ROMs living at the same address. Even if they have the same contents, it's likely to cause signal problems.
Now, pull the jumper and the logic board ROM is disabled, and the socketed ROM is solely in charge and things are good again. This is why you can't have both at the same time.