Yep. PBLlite is fast. That is what I used.
I have a suspicion that what is happening is redundant patching.
In your step 2, you have loaded your custom retail, which has the signature modification done, but in step 3, NKP loads the softmod bios which attempts to also patch the same section of the bios (in memory) that you've already modified (in the BFM). It should crash before it even loads the dash, but it doesn't, and for some reason, the effect of this "redundant patching" doesn't occur until you try to load an xbe after the xbox has fully booted to the dash.
Here is an idea. (I think I have this thing licked)
Try this. Take another fresh copy of retail 4817 and ONLY remove the HD check and DVD-Rom check, BFM it, and then use that in your step 2. From there, you will be "ever-so-slightly" modified retail, and should be able to install, and boot a softmod.
The reason this should work is because in theory, it isn't possible for a softmod bios to patch out the HD and DVD checks, because these checks are done before the BFM loads, therefore, it is safe to assume that BFM's don't touch the regions of memory where these checks are contained. If this is indeed the case, we should be able to remove the checks without repercussion, while still allowing NKPatcher to do it's thing.