Is there a byte of ROM which is unused in normal operation?

I want to decode the address bus, pull ROMCS down and put data on the data bus for one address only.

Is there an address in the ROM that is never used in normal operation of the ZX Spectrum? Perhaps I could find the position of a character's bitmap, and then never use that character?

Solution

It's hard to point at any single byte without having a ZX programming reference or the ROM contents handy, but I may give you some ideas:

choose a function that you aren't going to use (say, saving to the tape), use its entry point as the address
find where the the font is stored, choose a byte in one of the characters. Most likely everything will still work, but you'll get that line in the character drawn incorrectly
choose the location where execution starts when you power it up, but wait out with enabling your circuitry until after the first instruction has executed
literally look for unused sections, those are probably going to look like fairly large contiguous runs of 0xFF bytes (wait, I've found the ROM in an emulator, there is such a region, from 0x386E to 0x3CFF, but I don't know if this ROM is original or altered, you'll need to examine yours)