Found it.
add 0x10 for header
Change 0x1a734 from 40404141 ---> 3f3f4040
How I found it (for those who are curious):
In FCEUX I used cheat search to find the memory location for facing left or right, found it at 0x7b. 01=right, 02=left
In the debugger, set a read breakpoint on 7b
Stops in one spot:
>06:A405:A5 7B LDA $007B = #$01 <-- load the player's current facing direction
06:A407:C9 01 CMP #$01 <-- compare it with 01; Is the player facing right?
06:A409:D0 03 BNE $A40E <-- if not, skip the next 3 bytes
06:A40B:4C B0 A5 JMP $A5B0 <-- run this if player facing right
06:A40E:4C F9 A5 JMP $A5F9 <--- run this if player facing left ** This is the spot we want to look into **
06:A411:AD 10 06 LDA $0610 = #$4C
06:A414:C9 10 CMP #$10
06:A416:B0 01 BCS $A419
A short bit below A5F9 we have a bunch of "LDA, X" which is probably tables for srite stuff, so I do a "step into" until it hits one of them.
It runs the one at a638:
>06:A638:BD 34 A7 LDA $A734,X @ $A734 = #$3F
06:A63B:8D 30 06 STA $0630 = #$3F <--- this is where it sets the player's frame
Setting a new breakpoint for execute on a638 we see that X goes from 0 to 3 so we know it's looping 4 bytes at a734. If you hover over it in the debugger it gives the real address which is 1a744 (1a734 without header).
I found the right value for the frames by setting it manually using the cheat function, since we see it uses 0x0630 for the current frame. I figured it was probably off by one, since it seems like a bug.