I rechecked the datasheet and found two things -

ALE lo-to-hi transition latches in the address, just as you have done. My mistake.

Also, and this is important, the OE input is high-active, meaning that your code de-asserts the data output right before you try to read it in. Oops! I also assumed OE was low-active. We all know what happens when we assume...

- Lee