Moving this to R&D...
I have a general method that I use which works most of the time. I've considered writing a tutorial detailing it but ah, there's never enough free time. Anyway, first I open the ROM with VBA-H and use its logging capability to track calls of DMA3 and SWI and then search through the results for the address I'm looking for. The good thing about this is that it also catches the decompression of any data which comes in handy for a lot of graphics in particular. If I don't see the address in the log file, then I fire up VBA-SDL-H and put a breakpoint on the address of the image/tilemap in the VRAM. This allows me to see exactly what's going on when the game writes to the VRAM. If the game breaks on a SWI call, then I can check the registers (r0 usually has the source) to find where the data is located in the ROM. If the game breaks on something like "str r0, [r7, #0x00]" and r7 contains an I/O Register address ('0x0400:0XXX'), then it's probably utilizing one of the DMAs. And if it's just a "str/b/h" or "stmia" instruction, then you'll have to decompile some routines to trace where the data is being read from, which, admittedly, can be a very tedious process.
Also, some of the time (I see this more with compressed data), the game copies the image into the WRAM and from there copies it to the VRAM. I'm assuming this has something to do with with buses and all that technical, hardware stuff that I don't understand.