Final update:

Who could have figured ... it wasn't that I was doing it wrong, it was that I wasn't typing fast enough. When I just Telneted in and typed the commands, they didn't work, but firing them from my controller they did. Glad I just tried it instead of ripping my hair out wondering what I was doing wrong. The full set of commands is available from Pioneer, but their doc has zero explanation or calrification, and one error: for remote codes, you tag a /RU on the end, not just /R like they say. Everything has to be terminated with a CR (hex 0x0D).