Of course, as one does, I spotted a bug right after hitting 'send' :-)

The unveil() call needs to be made from inside main(), after the call to
initscr(), and then be called a second time with two NULL arguments.
Fixed in my tree.