Thanks for those links! The one that help most of all was:
Although I didn't actually figure out exactly where in the DHCP process the default route is configured, I figured out why my specific setup was failing. The wireless module contains its own DHCP server. That server was incorrectly reporting the "Router" IP address as A.B.0.0. I noticed when everything was working fine, the Router address and the network interface IP address matched. Looks like there's a bug in the wireless module which is clearing the least significant 2 octets of the Router IP address.
BTW - this module is a cellular modem, not a WiFi card, so there's really no LAN at all, even though it looks like a Network Interface to the Linux host. Since there's no LAN, there's also no router, so I guess that's why the DHCP server makes the router address the same as the leased IP address.
It took some reading and thinking - thanks again for passing those links.