Upon closer ispection I discovered that the CRC was a 16bit CRC. I should have thought of that first, but because I was using Python's crc32 to experiment, I didn't really try CRC16.

The following steps(for a 2.7.3 rom) produces a Noop image file that boots, and verifies some of my guesses.

1) made a copy of Xncd19C and modify the first instruction to 'jmp R1'.
2) try booting this, it failed.
3) after the CRC error, inspected the 2bytes at address 0x8000b64, and 0x8000b66. These contain the actual and specified CRC.
4) modify above image and changed values at file offset 0xcc to the value at 0x8000b64, and booted again. This time it gets to 'starting server' and then the > prompt confirming that the server is called and when returned it returns to the command interpreter.

I suspect there's a bit somwhere in the file that can specify "no crc", but I havn't found that yet. If I don't find it soon, I'll probably proceed to write a script that just sets the correct CRC.