Add block shuffler detection and attempt to mimic vanilla behavior

[idlechild]

If a certain PLM draw function is commanded to draw zero values, this is our clue that block shuffler is happening. I believe there are other, less powerful variants of block shuffler, but this one that clobbers the entire bank $7F (except the first two bytes) is the one we're interested in. When the draw function is told to copy zero values, it copies 65536 values (65536 words; it loops the whole 16-bit address space twice).

This creates a couple problems for the practice hack:

• It copies from $0000-$1FFF WRAM, which the practice hack does repurpose some unused values
• It copies from $8000-$FFFF Bank 84, which the practice hack has patches in several places

Now that we know where the block shuffler is happening, we can shield some of the practice hack stuff (similar to what we did for spacetime beam). If copying from $F000-$FFFD space, we know that should all be $FFFF, so we can write that value. With that area protected, we can move all of our Bank 84 freespace stuff in there (starting at $F002 just in case we try to copy a word from $EFFF; this is also why the space stops at $FFFE).

That still leaves us with some patches that we can't move, and also the WRAM that we can't un-repurpose. Thus after block shuffler runs, some cleanup occurs to write the vanilla values in where we may have copied non-vanilla values to bank $7F.