I'm a bit confused...by your comments in your code seem to be treating T2 is a signed counter, where in reality it is an UNSIGNED counter. It counts up to 0FFFFh, sets TF2 and resets. How can you get any negative out of it?

A comment: you are reading T2 while it is running. What happens if right after you read TL2 and before you read TH2, TL2 increments and overflows, incrementing TH2? What you are displaying will then be incorrect.

Since you cannot read both bytes simultaneously, and if you cannot stop T2, you should read TH2, then TL2, then TH2 again. If the second read of TH2 doesn't match the first, then you know that this overflow condition occurred and you should then zero out the low byte.

Dennis