I wind up with
BASEX_JVM="${BASEX_JVM} -Djdk.xml.maxGeneralEntitySizeLimit=0 -Djdk.xml.totalEntitySizeLimit=0"
out of not being clear where the default values for BASEX_JVM originates these days. It does seem to be set before basexgui uses it.
By default, it is unassigned, but it is possible to assign a value, which will then be adopted by the start script.
As a note, I think I was already using the internal XML parser, though if I go look at the »Parsing« tab in the »Create Database« GUI, "Use internal XML parser" is both checked and greyed out, and "Use XML catalog file" has that value and is both checked and greyed out.
Interesting, this combination is not intended to exist (the internal parser does not support catalog resolution). With the next release, internal parsing will automatically be deselected in the GUI if a catalog is chosen.