When can uid 1 get an access denied page?
After trying to fix this for an hour, I tumbled on the solution right after I posted this.  Apparently, it is possible to set a theme as "default" but not have it "enabled", and have a site function normally.  Enabling the theme fixes the problem.