Thanks for the info Lefty!
I'll have to try both, 12MHz and 16MHz and see how it goes. I should be able to code around the millis() problem at 12MHz but 16MHz would be much nicer... on the other hand, debugging can be hard enough as it is, without having to worry about random logic errors from running the uC out of spec.
I'm not using it for anything health & safety related - no nuclear cats or reactive scanners. It's basically just running an array of sensors. But I like things to work correctly, even if they're not mission-critical.
Cheers!