Okayokayokay... if you're having fun watching me obsess over it (sicko), I've got one more bone I can toss you for now.
I threw the 'scope on the three wires that are used for communication between the two modules, and at first glance it doesn't appear they're running anything as complicated as the synchronous serial protocol I speculated about earlier. I haven't done much with it yet - just watched the lines when I enabled and disabled the security system - and I think they just strobed one line to signal the change of mode. I'll have to read a little more closely to see how many different states there might be and try to correlate that with how the state change signals might be encoded, and look at the microcontroller's data sheet to see what the pins (on each board) serving those three wires are capable of.
Other than getting in and out of valet mode I haven't been very interested in the security module, so I don't get yet what-all sets it off. The easy thing to do on the bench is just give the shock sensor (that little grey box in the upper right) a little rap, but obviously there are a bunch of other conditions that can trigger it, so they'll represent different messages being passed. We'll see about all that later.