The address calculation was wrong, as the addition of the lower 16 bits is a signed addition, so if bit 15 is set, the upper 16 bits need to be incremented by one (so the hi portion of the symbol always references the symbol + 0x8000).