No luck with the signal generator. Altering the amplitude of the signal from the hall sensor did not change the reported motor temperature.
The hardware is all there, but the firmware in the controller is not interested in multiplexed speed+temp signal. I've been reading more about it, and it seems people have altered the data stream between the controller and the display to inject temperature. So it's the fault of the firmware in the controller alone.
The controller reads about 0.32v low across the the full range (so all functions related to voltage should be off a little), and speedo tire circumference presets are for thinner tires in general, around 1.75" for 26".