Dwayne,
I have done exactly what you suggest.
a. moved the download code to 1F00h for 16f877 and 0F00h for 16f873(not
really, I have only '877).
b. defined 0004h as load start address.
c. defined 0005h  as run start address.

In downloaded program I just put at 0004h a goto the real ISR and at 0005h
the start of user program.
I have seen an other downloader that implemented a PW to protect
unauthorized download, this helps
but not solve the protection of code.
Download is really interesting in development cycle but not in production.

                       Claudio Rachiele IW0DZG