As far as your code is concerned...your Perl looks sound and simple...although I haven't done a lot of CGI work. What about:
Does the event keycode make any difference? Do you know that the CGI script is called with each tab?
Also, I think your response CAN have a header...although I'm not sure it needs one...seems like I've sent back just raw text before in as an AJAX response. But that is what all the wonderful frameworks out there help nicely with.