If you can't steal any extra bits for the bass/treble controls, how about this? Have a config.ini setting:

[Hijack]
BassTrebleMultiplier=2

Then, each click of the knob (and therefore each bit increment in flash) becomes +2 or -2 instead of +1 or -1. You get less resolution (can set bass to -2 or -4 but not to -1 or -3), but a greater range (can go up to -12 instead of -6).

Make the config.ini option integer-only so the display doesn't get corrupted, and cap it at a sensible value so you don't exceed the "+" limit of the hardware (which I think is probably different whether you're stealing two EQ bands or using the DSP's built-in bass/treble if you ever manage to figure out how to do that).