I do not know where in the world you are. I have to assume you are in the UK, because of your reference to the Computer Misuse Act. This answer is intended to generalize a bit, by referring to the U.S. Computer Fraud and Abuse Act (with which I am more familiar).
I do not think the issue you would face would be because of the defacement of the client-side form validation, per se. Instead, the issue would be with what that defacement permits you to do. But the end result may be a violation of the site's Terms and Conditions of Use, and violation of the Ts&Cs may in turn amount to a violation of the Act.
Both the Computer Misuse Act and the Computer Fraud and Abuse Act make unauthorized access and attempts to impair the operation of a computer unlawful. The CFAA has been interpreted to include exceeding permitted access within the scope of unauthorized access. An argument could be made that, to the degree changing the client-side validation permits you to change your access to the system, it could lead to attempted or actual violation of the Act. For instance, although it is a tragically stupid one, the proprietors of the website may believe that client-side validation is effective in limiting malicious uses of the site. If so, even though it does not actually permit malicious activity, using the site without permitting the client-side validation could exceed the acceptable use of the site and therefore your level of authorized access.
Could this be prosecuted? It may depend on where both you and the affected computer systems reside. For instance, in the U.S. Ninth Circuit, the CFAA is interpreted fairly narrowly with regard to "exceeding access". I would not anticipate it would be considered a violation there. In the Seventh Circuit, the interpretation is much narrower. In Int'l Airport Ctrs. v. Citrin, for example, the Seventh Circuit held that an employee (soon to become ex-employee) exceeded his access when he erased files from a computer after deciding to quit. Erasing files as a loyal employee would not have been a violation. But because he had decided to quit, his agency relationship with the employer had terminated and with it his right to delete content from the computer (other access may still have been authorized). In other words, it can be a bit of a mess.
(I do not know anything about interpretations or likely interpretations of the Computer Misuse Act, and cannot speak to whether it is similarly a mess. I would be wary that it well may be. Also, note that both Acts claim to have extra-territorial application: you can violate the CFAA even if you are a U.K. citizen sitting in London, if the computer you are affecting is in the U.S.).
In my view, your best play in a situation like this one is to let the website operator know about the problem, ideally repeatedly and loudly until they start taking security more seriously. In the meantime, if you feel comfortable doing so or it is necessary, reduce your password length to something with less entropy. Aside from being too much trouble, it could be annoying or painful to remove the input validation. If the site will not mend its ways, and if you are not comfortable with a short password (or with the thought that the site may be so security unconscious that it finds the short password length acceptable,) stop using the site and loudly explain why you are doing so.
Incidentally, while I agree with everything in @BlueDogRanch's answer, it is worth noting that badly-written services sometimes rely on client-side validation as a bandaid for garbage code on the server side. I wish I had never seen it, but I have. So while in the general case it is correct that it should be impossible for you to cause a buffer overflow on the server because of bad input, "should be" may not be the same as "is".
