Ahh, I totally forgot what the text for surfing in FR was. I actually had to play my cartridge to figure it out
metapod, the pointer for the Surf byte's text is at 001A6AEF. It appears to be largely stored the same way as the 8F behavior byte, however, as you might expect, Surf isn't done with a regular script. None of the surf pointers lead to standard XSE scripts, so you'll have to decipher the hex/ASM yourself to edit that.