Many thanks to Mark Woodmass (Woody) for patching the image, explanation follows:

The problem (d'oh!)
===================

The game loader runs fairly similar to lots of others. A standard bootsector loads several more disk sectors using +3DOS functions which loads the main game loader into memory and passes control to it. Here we have the usual gazillion code decryptors and the normal array of disk sector tricks designed to make the game disk difficult to copy but there's nothing particularly out of the ordinary and the game loads fine from a good disk (or disk image) such as this one...

But whoever wrote the code that runs the game after loading needs shooting...

Immediately after loading we find this code at #A235:

    LD   A,(#5B5C)
    AND  #F8
    OR   #30       	; disables paging
    LD   BC,#7FFD
    OUT  (C),A
    LD   (#5B5C),A
    LD   HL,#2758
    EXX
    LD   IY,#5C3A
    JP   #5DC0     	; jump to the game code

Note that the paging has now been disabled in the system but we're still running in IM 1 mode at this time.

Now we reach #AE7A:

    EI             	; enabled the interrupts
    HALT           	; and let the ROM ISR run one more time

Note that the game switches to IM 2 interrupts shortly after this HALT, so the problem then goes away. There's only the one chance here that the game can be crashed.

Let's look at a part of the code that runs in the ROM ISR...

    BIT  4,(IY+#01)	; are we in "48K" mode?
    JR   Z,L387C   	; skip the CALL if so

    CALL #387F    	; carry out the +3 mode ISR section
L387C:    POP  IX
    RET

And the +3 mode ISR code at #387F:

    LD   BC,#7FFD
    LD   A,(#5B5C)
    OR   #07    	; attempt to page in bank 7 as normal
    OUT  (C),A    	; this fails as paging has previously been disabled!
    LD   A,(#E600)    	; so this reads from bank 0, not bank 7
    OR   A        	; and is always non-zero
    JR   Z,#38AC    	; so this forward branch is never taken

    LD   A,(#5C78)    	; read the low byte of the FRAMES system variable
    BIT  0,A    	; bit 0 toggles on each interrupt, so it's 50/50 whether this branch is taken
    JR   NZ,#38AC    	; branch forward if bit 0 was set

    LD   A,(#E600)    	; this code should decrement the "motor off" timer on a +3
    DEC  A        	; but we're still in bank 0, not bank 7
    LD   (#E600),A    	; so we actually just overwrite a graphics routine instead!

So there you have it. In order to run the game, you simply have to select the "Loader" option on the correct 50th of a second and it works! One 50th/sec too early or too late and it happily overwrites a graphics routine leading to on-screen graphical corruption and ultimately to a system reset as it scrambles other areas of memory.


The solution
============

Luckily solving this little issue is extremely easy. All we need to do is ensure that the +3 mode paging section of the ROM ISR doesn't run, and to turn that off we need to clear bit 4 in the FLAGS system variable at 23611.

That can be done by manually clearing that bit using "POKE 23611,205" which clears bit 4 whilst retaining the correct values for the other bits, and then loading the game, or by patching the disk bootsector to do the same.

The patched disk image simply has an extra opcode in the bootsector, RES 4,(IY+1), which also clears bit 4 of the FLAGS system variable, and a recalculated bootsector checksum in order to still boot correctly. And that's it, the problem goes away! :)