... Here's the correct default power-up values for $01:

C-64: +55(dec), $37(hex), low nybble = %0111(bin)
SX-64: +7(dec), $07(hex), low nybble = %0111(bin)
C-128 in 64 mode: +119(dec), $77(hex) = %0111(bin)

Also, you should know that these readings are taken directly from 
my own real NTSC Commodores in their stock configurations.

You mentioned that you're using an SX-64 ROM from funet. Well, both the 
SX-ROMs I downloaded from funet initalize the $01 I/O port the same way. 
It all happens during INITI/O at $FDA3:

 ; Set CHAREN (bit 2), HIMEM (bit 1) and LOMEM (bit 0)
$FDD5 LDA #$E7  ; = %1110 0111
$FDD7 STA $01
$FDD9 LDA #$2F  ; LSBs set to output
$FDDB STA $00

On CCS64 with the funet SX KERNAL ROM, "PEEK(1)" yeilds +55(dec)/$37(hex)/%00110111:

PRINT PEEK(1)

55
READY.

while the same PEEK(1) on my *real* SX-64 gives +7(dec)/$07(hex)/%00000111:

PRINT PEEK(1)

7
READY.

I assume this is due to the fact that the higher bits of the I/O port on 
the *real* SX are connected to *nothing but air*. Of course in CCS64, the 
cassette hardware connections are still emulated regardless of which ROM 
you're using.

For the rest of the KERNAL, all other references to $01 are during tape 
I/O and the 3 LSBs are "windowed" to protect them from overwriting.

Any time you clear CHAREN low, the $D000 I/O area is "covered" by the
Character Generator ROM. However, the HIMEM and LOMEM configurations take
precedence over CHAREN. Therefore, in any configurations with both HIMEM and
LOMEM clear (low), the 4k RAM will appear at $D000 regardless of CHAREN.
For this reason, the only way to "disable" I/O and keep both KERNAL and 
BASIC active is to clear CHAREN (low) and leave HIMEM and LOMEM set (high). 
The following POKE from BASIC will have the effect of covering I/O with 
the Character Generator ROM while leaving HIMEM and LOMEM unaffected:

POKE 1,PEEK(1) AND 251:REM MASK CHAREN

After this POKE operates on $01, a BRK is encountered somwhere in the process. 
I don't know where because I haven't traced the flow of the interpreter's 
POKE routine, but I assume problems will occur at the first IRQ since I/O 
has disappeared.

From the BRK, the IRQ handler will pass control to the BRK routine through 
the BASIC warmstart vector at $A002. The BASIC warmstart routine calls INITI/O 
and the code at $FDD5 causes $01 to be set back to its default value.

After control is restored to the BASIC interpreter, my C-128 in 64 mode 
gives a "SYNTAX ERROR" to any command typed. My SX seems to recover a little 
better and function normally.