Okay, so at least the bootloader is OK => we can troubleshoot it. The boot flag is active in the camera, no reason to change it. Camera starting without card is also encouraging.
Starting from the card with working ML Rescue (aka portable display test), copy a recent nightly build. Do you get any sort of activity (LED blinks, menus, logs)?
When I try to insert a card and they format it, the camera locks up.
Who are they? Canon's format dialog?
Any pins bent in the CF slot?
If the card I/O is not working in the main firmware, we may need some additional hardware to get logs (e.g. a photodiode to capture LED blinks).
Just FYI: there are two card drivers in Canon firmware (this applies to both CF and SD models): a simplified one, present in the bootloader (which loads autoexec.bin and FIR) and a full-featured one (with DMA, pretty complex) used in main firmware. If there's a minor hardware defect (such as a status signal missing), it is possible for one of these drivers to work, while the other may fail (I can find examples for both cases). So, camera loading autoexec.bin doesn't necessarily imply the card I/O is working in the main firmware.