Ok, I find a way to make the ceiling-bashing problem go away, at least in DOSBox.
Attached is a tiny program that changes DOS's memory allocation strategy. In DOSBox, if you run this program first, and then run Lemmings, I find that the ceiling bashing problem will go away in for example, Mayhem 28.
It might feel a little wrong to some of you. However, this program does not touch the game's program and data at all; in fact it finishes doing its work before you even run the game. It is conceivable that there might be real DOS application programs out there that if run, may produce the same effect.
The program should work fine in actual DOS as well. The only thing I haven't taken care of is to actually ensure that the memory being accessed by the game during the problem are actually all 0s. The change in DOS's memory allocation strategy means the game is now truly accessing memory not owned by the game or any other programs, so it's still possible that a previously run program could've used the same memory addresses and left over some byte values there, although it should be unlikely if you haven't run any other programs (besides lastfit.com) before running Lemmings. If I have time I could write a longer program to try to zero out the memory as well.