So the USB-Serial cable arrived in my mailbox yesterday.
Got into the router via a terminal window (Mobaxterm), reflashed the firmware to a lower level (v1.04.28) and did an nvram erase. Seems there's a bug in the latest version (v 1.04.46) that causes the nvram to fill and not be able to clear it on its own.
Got both routers working in a normal state, although one of the routers keeps dumping
Magic bitmask 0x1985 (and other addresses) not found at 0x043a0010 (and other addresses): 0x4c18 (and other addresses) instead error, which lengthens the boot time.
Wireless performance has also dropped significantly but it's better than leaving it as a brick, i guess.