the MeeGo kernel or something in userspace seems to overwrite the memory at the addressable space where multiboot is stored.

bootmenu might need to hijack initfs closer to when NOLO lets go in order to allow this? You'd have to ask somebody who knows the loader process.