You guys are great! Whew, that was scary...

iiewpie was right about ExMenu0.
Using Alex's decryption code, I created a decrypted firmware file
from e3kr111.fir. Then I hexedited it and changed
the byte at offset 121CBDh (first byte of ExMenu0) to 1,
ran it through the decrypter, and put it into my 300D.
Sure enough, a secret menu came out!
On the 3rd, there is a new item at the bottom called "Color"
when you select it, a very strange menu comes up that looks like
it's for calibration or something. It has 2 boxes and AEB/AF/AE/ISO.
when you hit the arrow buttons some other information appears. I'm
afraid to hit the Set button for fear of messing up some internal
settings of the camera. Too bad it doesn't do what we wanted, but
interesting nevertheless.

One thing that surprises me is that the firmware loader doesn't even
compute a checksum to make sure the firmware image isn't corrupted!