Took me a while to find this answer, so sharing here... Lollipop uses different routing tables with rules per user and/or interface. Here is a sample when I'm connected on wifi:
root@hammerhead:/ # ip rule show
0: from all lookup local
10000: from all fwmark 0xc0000/0xd0000 lookup legacy_system
13000: from all fwmark 0x10063/0x1ffff lookup local_network
13000: from all fwmark 0x10064/0x1ffff lookup wlan0
14000: from all oif wlan0 lookup wlan0
15000: from all fwmark 0x0/0x10000 lookup legacy_system
16000: from all fwmark 0x0/0x10000 lookup legacy_network
17000: from all fwmark 0x0/0x10000 lookup local_network
19000: from all fwmark 0x64/0x1ffff lookup wlan0
22000: from all fwmark 0x0/0xffff lookup wlan0
23000: from all fwmark 0x0/0xffff uidrange 0-0 lookup main
32000: from all unreachable
root@hammerhead:/ # ip route show
# As in your example, there's no default route here
192.168.0.0/24 dev wlan0 proto kernel scope link src 192.168.0.42
root@hammerhead:/ # ip route show table wlan0
#But here you find it in the wlan0 table
default via 192.168.0.253 dev wlan0 proto static
192.168.0.0/24 dev wlan0 proto static scope link
Routing tables are read by priority (the first column in the ip rule show display), using the first match.
You may alter a given routing table by adding 'table table_name' at the end of ip route ... commands.
And thus to get the first available default gateway:
for a in $(ip rule show | grep lookup | sed -r 's/.* lookup ([^ ]+).*/\1/'); do ip route show table $a | grep ^default | cut -d ' ' -f 2-5; done | head -1