Looks like bootloader and programmer work OK. Still a few things to do, like retry transmission, better detection of ZPUino on startup, and implement drivers for flash other than M25P16.
But generic flash programming seems to work very well. In future, if FPGA is also using SPI for program storage we can program both (FPGA and ZPUino) from a single application (will be slower, because I'm limiting programming to 115200 baud).
Jack decided to offer me a prototype of the upcoming Papilio Overshield (It's a Spartan3E with SPI flash and voltage level converters (5v) that looks like another arduino shield). Looks very promising.