Couldn't resist looking into this more and I must admit that I am a bit
stumped.  If instead of returning a value from the cache fast path in
_PyType_Lookup, I modified the code to store the value and assert that
it matches with the non-cached result from traversing the mro.  That
assertion never fails.  However, test_incomplete works with this change
that ideally should not alter the semantics of _PyType_Lookup.

More so, if I selectively don't cache the name "next" (with the caching
fast path reenabled), test_incomplete works.  For test_incomplete,
_PyType_Lookup on "next" always return NULL from both the cached and
non-cached paths.  

I'm beginning to suspect there is some black magic going on.  None of
the relevant reference counts drop to zero, the same return value (NULL)
is generated, but the slow patch seems to be doing something with a side
effect that makes it work.

Wish I had more time to debug this, but I'm already overdrawn until
Wednesday...