So it turns out that scrypt is barely better than SHA-256 in terms of CPU/GPU performance ratio. Maybe tuning parameters can make it better, but it seems that the whole idea isn't working. From litecoin wiki:
GPUs still do prove useful for Litecoin mining, though the improvement over CPUs is less significant than it was for Bitcoin mining (e.g. 10x speedup instead of 20x speedup).
But looking at mining hardware comparison page, difference seems to be lower than 2x.
OK, so aren't there hashes which offer higher competitive advantage to CPUs?
I'm really not an expert in this matter, but from what I know GPUs really do not like conditional jumps: with those jumps there won't be enough work for all ALUs within one stream processor. So are there hash algos which do that?
First thing which comes in mind is to make operations which are performed dependent on input itself. It might be structured in a way similar to scrypt, but with an additional step where bits of expanded input define what operations to perform on that expanded intermediate result.
Each such operation should be non-parallelizeable so that only one ALU of a stream processor can work at a time.
I think there really is a case for CPU mining since it gives ordinary people a chance to mine coins for themselves. This makes sense for in-game currencies: some people really do not want to spend real money to get game money. And I guess ideally it should work well with browser-based mining so that people won't have to install anything to get money.