You're going to have to get comfortable with the FCEUX debugger.
To solve the problem with the wrong palette:
Palette are assigned using a "attribute table". You can see it by opening the hex editor in FCEUX, then choosing PPU. The name table is probably address $23C0-23FF. Each 2 bits in the name table assigns the palette for a 16x16 pixel (2 tile by 2 tile) potion of the screen. So, a full byte controls are area 4 tiles wide by 4 tall. 8 bytes will control an area 32 tiles wide (the full screen width) by 4 tiles tall. So you can use that to mathmatically narrow down what byte controls the problem tiles.
Or just randomly change the values in the hex editor and see where on the screen the colors get corrupted.
But when you need to change that, it's usually easy. The attribute table is small enough that it is often stored uncompressed in the ROM. So you when see the full table in PPU RAM, just search for a match for the same data in the ROM.
As for the wrong letters, that's a bit harder to solve if you don't know ASM. You can do it with the debugger.
Open the Name Table window, point to the tile, notice the PPU Address (and the tile ID, which is the value for the letter you're clicking on) on the Properties area in the corner of the window.
Now reset and get to one screen before the error.
Go to the Debugger, go over to Breakpoints, click Add..., type the address, click PPU and Write. OK.
Now run the game. Hit the button to make the game load the team select screen. The debugger will come up stopping on the instruction that is trying to write to the PPU RAM (it's probably a STA $2007 instruction, or Store A to $2007. Now go look at the "A" register to the side to see the value it's trying to write. Is the same as the Tile ID for the character? No, then click Run to continue. Yes, then scroll up a couple times to see the instruction that loaded the value. (I get LDA $0141,X @ $014D = #$0C if you're following along.
That means it read #$0C (the tile ID for the letter C) from address $014D. $014D is a RAM address, so we need to trace back to find the ROM address.
So now, we need to use the debugger to find out how C go into address $014D.
Erase the current Breakpoint from the list and then reset the game.
Now we want to repeat the process to find how #$0C got written into $014D.
And repeat until we find it has read from a ROM address (something between $8000-FFFF). This could go awhile.