Looks like what you are trying to do is impossible. With RAMXGU RAMSHL set to their min value $80, CPU12X can't write F8000'G-F80FF'G. So you have two options, either not use protection at all, or reserve 256 bytes for XGATE only. I would put XGATE stack there.