diff --git a/kernel/shell.asm b/kernel/shell.asm
index 491260b..4c3ad56 100644
--- a/kernel/shell.asm
+++ b/kernel/shell.asm
@@ -42,14 +42,12 @@
 
 ; Places where we store arguments specifiers and where resulting values are
 ; written to after parsing.
-.equ	SHELL_CMD_ARGS	SHELL_MEM_PTR+2
+.equ	SHELL_CMD_ARGS	@+2
 
 ; Pointer to a hook to call when a cmd name isn't found
-.equ	SHELL_CMDHOOK	SHELL_CMD_ARGS+PARSE_ARG_MAXCOUNT
+.equ	SHELL_CMDHOOK	@+PARSE_ARG_MAXCOUNT
 
-; Pointer to a routine to call at each shell loop iteration
-.equ	SHELL_LOOPHOOK	SHELL_CMDHOOK+2
-.equ	SHELL_RAMEND	SHELL_LOOPHOOK+2
+.equ	SHELL_RAMEND	@+2
 
 ; *** CODE ***
 shellInit:
@@ -58,7 +56,6 @@ shellInit:
 	ld	(SHELL_MEM_PTR+1), a
 	ld	hl, noop
 	ld	(SHELL_CMDHOOK), hl
-	ld	(SHELL_LOOPHOOK), hl
 
 	; print welcome
 	ld	hl, .welcome
@@ -70,10 +67,7 @@ shellInit:
 ; Inifite loop that processes input. Because it's infinite, you should jump
 ; to it rather than call it. Saves two precious bytes in the stack.
 shellLoop:
-	; First, call the loop hook
-	ld	ix, (SHELL_LOOPHOOK)
-	call	callIX
-	; Then, let's wait until something is typed.
+	; Let's wait until a line is typed.
 	call	stdioReadC
 	jr	nz, shellLoop	; not done? loop
 	; We're done. Process line.
diff --git a/kernel/sms/pad.asm b/kernel/sms/pad.asm
index eb85948..b004f9d 100644
--- a/kernel/sms/pad.asm
+++ b/kernel/sms/pad.asm
@@ -11,6 +11,9 @@
 ;   The space character is the first among special chars.
 ; * C confirms letter selection
 ;
+; This module is currently hard-wired to sms/vdp, that is, it calls vdp's
+; routines during padGetC to update character selection.
+;
 ; *** Consts ***
 ;
 .equ	PAD_CTLPORT	0x3f
@@ -29,21 +32,18 @@
 ;
 ; Button status of last padUpdateSel call. Used for debouncing.
 .equ	PAD_SELSTAT	PAD_RAMSTART
-; Button status of last padGetC call.
-.equ	PAD_GETCSTAT	PAD_SELSTAT+1
 ; Current selected character
-.equ	PAD_SELCHR	PAD_GETCSTAT+1
+.equ	PAD_SELCHR	@+1
 ; When non-zero, will be the next char returned in GetC. So far, only used for
 ; LF that is feeded when Start is pressed.
-.equ	PAD_NEXTCHR	PAD_SELCHR+1
-.equ	PAD_RAMEND	PAD_NEXTCHR+1
+.equ	PAD_NEXTCHR	@+1
+.equ	PAD_RAMEND	@+1
 
 ; *** Code ***
 
 padInit:
 	ld	a, 0xff
 	ld	(PAD_SELSTAT), a
-	ld	(PAD_GETCSTAT), a
 	xor	a
 	ld	(PAD_NEXTCHR), a
 	ld	a, 'a'
@@ -78,14 +78,14 @@ padStatus:
 	ret
 
 ; From a pad status in A, update current char selection and return it.
-; Returns the same Z as padStatus: set if unchanged, unset if changed
+; Sets Z if current selection was unchanged, unset if changed.
 padUpdateSel:
 	call	padStatus
-	push	hl
+	push	hl		; --> lvl 1
 	ld	hl, PAD_SELSTAT
 	cp	(hl)
 	ld	(hl), a
-	pop	hl
+	pop	hl		; <-- lvl 1
 	jr	z, .nothing	; nothing changed
 	bit	PAD_UP, a
 	jr	z, .up
@@ -156,45 +156,51 @@ padUpdateSel:
 	ld	(PAD_SELCHR), a
 	jp	unsetZ
 .nothing:
-	cp	a		; ensure Z
+	; Z already set
 	ld	a, (PAD_SELCHR)
 	ret
 
+; Repeatedly poll the pad for input and returns the resulting "input char".
+; This routine takes a long time to return because it waits until C, B or Start
+; was pressed. Until this is done, this routine takes care of updating the
+; "current selection" directly in the VDP.
 padGetC:
 	ld	a, (PAD_NEXTCHR)
 	or	a
 	jr	nz, .nextchr
-	call	padStatus
-	push	hl
-	ld	hl, PAD_GETCSTAT
-	cp	(hl)
-	ld	(hl), a
-	pop	hl
-	jp	z, unsetZ	; nothing changed
+	call	padUpdateSel
+	jp	z, padGetC	; nothing changed, loop
+	; pad status was changed, let's see if an action button was pressed
+	ld	a, (PAD_SELSTAT)
 	bit	PAD_BUTC, a
 	jr	z, .advance
 	bit	PAD_BUTA, a
 	jr	z, .backspace
 	bit	PAD_START, a
 	jr	z, .return
-	jp	unsetZ
+	; no action button pressed, but because our pad status changed, update
+	; VDP before looping.
+	ld	a, (PAD_SELCHR)
+	call	vdpConv
+	call	vdpSpitC
+	jp	padGetC
 .return:
 	ld	a, ASCII_LF
 	ld	(PAD_NEXTCHR), a
 	; continue to .advance
 .advance:
 	ld	a, (PAD_SELCHR)
-	cp	a
+	; Z was already set from previous BIT instruction
 	ret
 .backspace:
 	ld	a, ASCII_BS
-	cp	a
+	; Z was already set from previous BIT instruction
 	ret
 .nextchr:
 	; We have a "next char", return it and clear it.
 	cp	a		; ensure Z
-	push	af
+	ex	af, af'
 	xor	a
 	ld	(PAD_NEXTCHR), a
-	pop	af
+	ex	af, af'
 	ret
diff --git a/kernel/sms/vdp.asm b/kernel/sms/vdp.asm
index b230fb2..ce6d271 100644
--- a/kernel/sms/vdp.asm
+++ b/kernel/sms/vdp.asm
@@ -21,11 +21,8 @@
 ; Row of cursor
 .equ	VDP_ROW		VDP_RAMSTART
 ; Line of cursor
-.equ	VDP_LINE	VDP_ROW+1
-; Returns, in A, the currently selected char in a "pad char selection" scheme.
-.equ	VDP_CHRSELHOOK	VDP_LINE+1
-.equ	VDP_LASTSEL	VDP_CHRSELHOOK+2
-.equ	VDP_RAMEND	VDP_LASTSEL+1
+.equ	VDP_LINE	@+1
+.equ	VDP_RAMEND	@+1
 
 ; *** Code ***
 
@@ -33,9 +30,6 @@ vdpInit:
 	xor	a
 	ld	(VDP_ROW), a
 	ld	(VDP_LINE), a
-	ld	(VDP_LASTSEL), a
-	ld	hl, noop
-	ld	(VDP_CHRSELHOOK), hl
 
 	ld	hl, vdpInitData
 	ld	b, vdpInitDataEnd-vdpInitData
@@ -121,12 +115,6 @@ vdpSpitC:
 	ret
 
 vdpPutC:
-	; First, let's invalidate last sel
-	ex	af, af'
-	xor	a
-	ld	(VDP_LASTSEL), a
-	ex	af, af'
-
 	; Then, let's place our cursor. We need to first send our LSB, whose
 	; 6 low bits contain our row*2 (each tile is 2 bytes wide) and high
 	; 2 bits are the two low bits of our line
@@ -267,26 +255,6 @@ vdpConv:
 	ld	a, 0x5e
 	ret
 
-; During the shell loop, updates the currently selected char, if appropriate
-vdpShellLoopHook:
-	push	af
-	push	ix
-	push	hl
-	xor	a
-	ld	ix, (VDP_CHRSELHOOK)
-	call	callIX
-	ld	hl, VDP_LASTSEL
-	cp	(hl)
-	jr	z, .noChange
-	; selection changed
-	call	vdpConv
-	call	vdpSpitC
-.noChange:
-	pop	hl
-	pop	ix
-	pop	af
-	ret
-
 vdpPaletteData:
 .db 0x00,0x3f
 vdpPaletteDataEnd:
diff --git a/recipes/sms/glue.asm b/recipes/sms/glue.asm
index d56c0b6..501ad64 100644
--- a/recipes/sms/glue.asm
+++ b/recipes/sms/glue.asm
@@ -33,15 +33,11 @@ init:
 
 	call	padInit
 	call	vdpInit
-	ld	hl, padUpdateSel
-	ld	(VDP_CHRSELHOOK), hl
 
 	ld	hl, padGetC
 	ld	de, vdpPutC
 	call	stdioInit
 	call	shellInit
-	ld	hl, vdpShellLoopHook
-	ld	(SHELL_LOOPHOOK), hl
 	jp	shellLoop
 
 .fill 0x7ff0-$