Well, this is how I would do it if I was attempting this:
The large red outlined rectangle represents the memory of the whole cartridge. In this case, two large capacity Flash ROM chips. One known as "A" and the other known as "B".
As you may know, the Elk or Master can select one of two 16k ROMs in a single cart.
So the higher numbered ROM (from the Elk or Masters perspective) is Flash ROM "A" and the lower numbered ROM is Flash ROM "B"(as the OS boots from the higher numbered ROM).
The !BOOT loader will be in the first 16k "bank" of the "A" Flash ROM (here coloured green and marked 00/A ). Then this loads a menu program located in the same area of the Flash ROM.
The menu program then loads a small copy routine into RAM and selects (using some clever circuitry) the required image in the correct Flash bank (shown here in pink and numbered 0B/A and 0B/B). It then either copies the image into RAM, or loads it as a ROM filing system image
Well, it works in my mind
Note that the last byte in all 16k banks is not usable, as the "clever circuitry" needs to use this memory location to select the bank required in the Flash ROM (using a 8 bit hardware register).
Now, I wonder how Dave H.'s design works