With the help of another answer to an E2E query, I found out that MSI interrupts can be handled by Mailboxes. That is fine because an MSI interrupt is 32 bits in size, and a mailbox message is 32 bits in size.
So that allows me to interrupt any of the processors on the TDA4AH.
However I have a slight problem with the MSI-X interrupts. They contain 64 bits and so do not fit into a Mailbox. How can an MSI-X value be routed to MCU1_0 in particular?