He says it's about 10K lines and has no test suite.

Ouch, then I assure you there are some other bugs in your friend's game.

"a race condition between loading the page and loading its CSS"

?? The browser accessing the website had the bug?

Testing multi-threading programs is hard: some approaches are statistical, others play with timing...at the end you check that the shared program space (or shared variables) are in a consistent and expected state, plus you always go looking for some input --> output correct relationship.