memory layout (erase happens in 0x0400 blocks)

--------------ffff
top page
--------------fc00

bootloader

--------------c000

application

--------------0403

ljmp 0c000h

--------------0400

(part of) startup and possibly
part of the application

--------------0000

the bootloader has two XDATA workbuffers:
"page 0" which is 'write'
"current page" which is read modify write
pages except page zero are written 'as needed'

startup is modified as follows:

STARTUP1:
	clr 	a
	mov 	dptr,#0ffffh
	movc	a,@a+dptr
	jnz		noboot
	ljmp	0c000h

noboot:

this code (not necessarily noboot:) is forced to page zero and start at an even address

to invoke bootload write a zero to code address 0ffffh and reset the controller.
when bootload is at the end it will erase and write page zero to the code memory and THEN erase the top page and then reset the controller

so, where can it fail?
first the "write a zero to code 0ffffh" does not involve an erase, so that is 'safe'
second, if it fails between "write a zero to code 0ffffh" and "erase and write page zero" any restart will go to the botloader.
now
erase page zero; I do not know if the erase is always the page, but believe it is and if the operation fails after the erase the code will trundle through the mov r7,#0ffh till it hit the jump at 00400h and start the bootloader
writing page zero, there is one place where a failure could occur (two writes, see below), but that is not a lot. first the jmp STARTUP1 is written, if the write fails while the interrupt vectors are written, the same will happen as with an erased page zero.
the only failure I can see if the write happens while writing 0c0 and 00 for the ljmp.

comments as to potential traps will be appreciated

Erik

PS: of course, the bootloader does not use interrupts.