While looking over the Zipit mainboard, I've discovered a few signals which appear to go nowhere. This is like the TXD2 signal, they go to a via but nowhere else (dangling). These are the other dangling signals that go nowhere. Only two are reachable from the top of the PCB, nCS2 and TXD2, the others are only on the bottom of the PCB as those vias are under the EP7312 TFBGA.

While using these pins are a bit of a challange, it would be nothing more than what you had to do with soldering to TXD2. I am thinking that a 30ga, or finer, enamaled magnet wire could be soldered to these vias, then tightly strung out to the edge of the PCB. Then, it could be connected to (wrap it over the PCB edge) to some tiepoint on the top of the PCB. To keep the wire in place, maybe use some clear nail polish, paint the wire to the PCB and wipe the excess polish (one swipe) with a tissue. This should leave a fillet of nail polish "under" the wire to tack it into place.

Care should be taken to determine how best to run this wire so that it does not interfere with the operation of the keyboard. I don't think that you would want to distend the keyboard under a key dome.

Here are where they are located on the bottom of the PCB. The "top" of this picture is where the keyboard FPC cable connector is located. You are looking under the TFPGA device within the Inset Area. Note the cover switch partially showing at bottom center of photo.

The vias and their TFBGA ball names.

The only signals which may be useful are: nCS2, TXD2, and PB5. Nice to have another port bit avialable, even if it is tough to use! The TXD2 location may just salvage a board when you overheat the pad on the topside, here you could still get at it.

The nCS2 signal is real interesting, that is an entire chip select! While you would need to run a bunch more wires (maybe only a few) to use it, it is there. I've checked two other boards and the nCS2 via is a slightly larger via with no soldermask. Soldering to it should be quite easy.