Someone left a list of RAM offsets for Ruby somewhere, and mentioned that they weren't DMA-encrypted there but they were in FR- one of them was options. I put a breakpoint on it in VBA-SDL-H (there are other debuggers but it's what I use) and found the code responsible for reading them before asking the player if they want to switch. I then took the surrounding ASM, searched for it in FR, and adjusted it to be unconditional. This actually broke some other things as well, most notably confusion (pokemon always hurt themselves while confused but had a 50% chance of doing 0 damage)- a bit of looking at the code while it ran revealed it was a battle script command, as well as the location of the script that was calling the command (x1D8727- the script as a whole starts a bit earlier which is why there's no pointers to the offset I gave you).
If I didn't have access to the Ruby options, I don't know how I would've found it- the options in FR are significantly harder to pin down. Another approach that I had considered taking (but never did) was finding the battle script that produces the "Trainer is about to send out X" message- it would be somewhere nearby and help me figure it out.
With regards to finding how Surf is handled, the text isn't the only relevant element- there's also the flag keeping you from using it until you have Koga's badge. That said, I looked into it briefly and found there actually is a pointer to the text- it's at x1A6AEF (pointing to x1A556E), and is part of a larger OW script.
To answer the question as a whole of how I figure things out- usually look for related elements I do know about and put breakpoints on them in a debugger.