There's no reason to believe anything is wrong with the board. Note that FriendlyELEC images work fine. The machine had been running on the sdcard for months (not really in use, but operating nonetheless), then I decided to start over again with the newest image (written with dd, 512 bytes at a time). All I did was write the vendor image, boot it, run updates, and reboot. That was enough to make it boot-loop.
I'm using a 12V 2A supply and a SanDisk 16GB EDGE A1 U1 Class 10, both were purchased from FriendlyELEC with the board. The heat sink is cooled with a 40mm Noctua soldered to the 12V supply. I'm booting from sdcard, not eMMC. I'm just writing the stock server image from the downloads page, booting it, running updates, then rebooting, and it boot loops.
Is there some way to get kernel console output on the serial port? Again, if I put the serial port as primary console, it will boot loop (even with stock sdcard image that boots fine otherwise), so in my mind that's something to fix first, to get more information from the early printks. (Note that adding some other seemingly innocuous things like either apparmor=0 or kernel.sysrq=1 to extraargs, also causes the "good" image to boot loop, but other options work fine like ipv6.disable=1 and selinux=0). If I could just get the kernel boot messages shown on the serial port...