doc/hw/sms: adjust ROM hacking instructions

Previous instructions would only work with an AT28C64. Now, it also
work with an AT28C256.

doc/hw/z80/sms.txt

@@ -8,8 +8,9 @@ had a z80 system for compatibility!
 This makes this platform *very* scavenge-friendly and worth
 working on.
 
-SMS Power[1] is an awesome technical resource to develop for this
-platform and this is where most of my information comes from.
+SMS Power[1] is an awesome technical resource to develop for
+this platform and this is where most of my information comes
+from.
 
 This platform is tight on RAM. It has 8k of it. However, if you
 have extra RAM, you can put it on your cartridge.
@@ -18,8 +19,8 @@ have extra RAM, you can put it on your cartridge.
 
 * A Sega Master System or a MegaDrive (Genesis).
 * A Megadrive D-pad controller.
-* A way to get an arbitrary ROM to run on the SMS. Either through a writable
-  ROM cartridge or an Everdrive[2].
+* A way to get an arbitrary ROM to run on the SMS. Either
+  through a writable ROM cartridge or an Everdrive[2].
 
 # Hacking up a ROM cart
 
@@ -36,13 +37,20 @@ SMS-related stuff, I recommend the 32K version instead of the 8K
 one because fitting Collapse OS with fonts in 8K is really
 tight.
 
+The ROM cartridge follow regular ROM pinout, which means that
+A14 are just under VCC, where WE is on the AT28. We need WE to
+be perma-disabled and A14 to be properly connected.
+
 1. De-solder the ROM
 2. Take a 28 pins IC socket
 3. Cut off its WE pin (the one just under VCC), leaving a tiny
    bit of metal.
 4. Hard-wire it to VCC so that WE is never enabled.
 5. Solder your socket where the ROM was.
-6. Insert Collapse OS-filled EEPROM in socket.
+6. With a cutter, cut the trace leading to A14.
+7. Wire A14 to the trace just under WE (which doesn't actually
+   touch WE because we've cut the IC socket's pin).
+8. Insert Collapse OS-filled EEPROM in socket.
 
 As simple as this! (Note that this has only been tested on a SMS
 so far. I haven't explored whether this can run on a megadrive).