I think this is a very complex problem to solve, and any tools that we do have are relatively young. However, I think there are some good options out there, and some people pioneering in this area.
I think there are two aspects to your proposed problem:
The most obvious is crawling. The tool needs to be able to map out the whole application, including any server requests that it might make, in order to achieve good coverage/breadth. Traditionally this is simply achieved by crawling the HTML page for links and forms that point to more pages, but this becomes difficult with Ajax communications and single-page apps.
Furthermore, client-heavy applications, with a lot of Javascript code performing application logic in the user agent, are somewhat more likely to have security bugs in the client-side code itself. Flaws like DOM-based cross-site scripting can occur in any application that utilises client-side scripts, so tools ideally need the ability to spot vulnerabilities in this code as well.
Some tools have been shown to posses these abilities, and the common denominator is the ability to process Javascript. For instance, tools like Crawljax can be used by pentesters to map applications by actually processing each page as if it were in a browser (sometimes by actually loading it in a browser instance). We also have great utilities like PhantomJS that allows Javascript code to be processed in headless mode.
Here are a couple of tools that I've used which make some attempt to achieve the above - both are open source:
OWASP Zed Attack Proxy (ZAP) - OWASP ZAP features an AJAX crawler (in addition to a traditional crawler) which actually spawns browser instances in order to render and process pages and identify new paths through the application. I don't think the automated scanners will detect a lot of client-side code issues yet, but ZAP has at least introduced some good features for manually testing these.
Arachni - This is, hands-down, the best automated scanner I've used personally, and a really great project in my opinion. It seems to do a really good job of crawling most HTML5 applications and it uses PhantomJS to process the Javascript (headless). Testing for DOM-based XSS and similar also seems to work fairly well.
I don't think any tools are particularly polished when it comes to modern HTML5 web applications, but there are certainly some making headway, and they will only get better.
It should go without saying that automated testing tools are very limited in comparison to penetration testing, especially in the appsec arena, and should therefore be used in conjunction (as the OP has acknowledged). My answer has assumed that a fully automated solution is required. Where a human operator can be constantly involved, something like Burp Suite is definitely a good option.
