You need to be clear about how to implement an FSM[1], and to distinguish between which element's setup and hold time you are referring to.
[1] hint: "state" implies flip flops
In timing diagrams, an EEPROM's address lines need to be valid for a certain period of time before the data is valid. Before that time, the state of the data lines in undefined.
So let's say the cycle counter is 0, so the EEPROM's address lines are 0x0000, and the data lines have the contents of memory location 0.
Then the counter changes to 1 and the EEPROM's address lines go to 0x0001. After a certain period of time, the data lines will have the contents of memory location 1.
But before then, aren't the data lines' states undefined? So couldn't they be anything? That would wreak havoc.
I don't know what
you mean by a "cycle counter", nor whether it is only part of your thought processes or whether there would be one in your implementation.
The ROM doesn't have a setup and hold time; it has a propagation time.
You could, in theory, use a ROM in the way you are hinting. It would be an unclocked FSM, i.e. an asynchronous FSM. There are solid theoretical reasons why asynchronous FSMs aren't used at the level you are considering. Asynchronous FSMs are used to implement flip flops and some relatively advanced concepts that aren't relevant here.
Your first conceptual design should be something simple, not a computer. I've frequently asked job interviewees for several ways in which they could implement a traffic lights controller. There is no single right answer, but their responses indicate a lot about their thought processes.
So, how would you use a ROM to implement a traffic lights controller? Start simple, then add an input that indicates a waiting car has been detected.