You could get the vector from the device table at $E400, the "keyboard get" being at $E424. This is a push and RTS value and so -1 from the actual address, i.e. stored lo/hi as $FC $F2 for $F2FD.
GetKeyVec:
JMP $FFFF
InitGetKey:
LDA $E424
CLC
ADC #1
STA GetKeyVec+1
LDA $E425
ADC #0
STA GetKeyVec+2
RTS
TestGetKey:
JSR InitGetKey
JSR GetKeyVec
...