Apparently I was wrong about boot sequence. The doc now states:
System will detect in sequence whether it can boot from the following device sequence: SD > eMMC > NVMe. For example, if the boot program is found on the SD, eMMC will be ignored.
It appears that to be able to boot from NVME I need to remove MMC.