Hmm. Crazy thought, but there must be some sort of save data function. I wonder if one could exude a ram chip(as opposed to short life flash or eeprom back then) as a storage device, with some fake filesystem, then have the software write updates to that.
As ram, you could read the data on the cartridge, modify it, and thus fake bidirectional comms?
Even if the bus/protocol is limited to "only" disk I/O, you could still have the controller interpret reads/writes to certain addresses as requests for other actions, including interaction with other hardware on the card
As ram, you could read the data on the cartridge, modify it, and thus fake bidirectional comms?