(1) Looks like there's a six-byte array at $09D3-09D8.
(2) & (5) That can be done by back-tracing the Attribute data for the sprites in question. It involves setting a conditional write breakpoint for a RAMslot in the $202,x field (where x = multiple of 4), the condition being based on a known Tile ID# value being present at the prior $201,x slot.
So, we know that the bottom-half of the fire flower is represented by Tile #D9. Thus, we set a write-breakpoint to $2B2, on the condition that $2B1 == #D9, and wait for the snap. Then, it's just a matter of backtracking a few steps to see where the game acquires the Attribute data (palette assignment, H/V flip status, etc.) for that sprite assignment.
(3) The OP's put the title screen layout in the CHR-ROM because it was the 1980's and brominated crack was a thing. There was a recent set of posts on this very subject within the past month; anyway, it involves editing strings of BG tile assignments under the typical light compression format of (2-byte starting address) (1 control byte) (Tile ID#'s.....). If you can't find that thread, I can assist.
Edit: Here it is!
http://www.romhacking.net/forum/index.php/topic,20581.0.html(4) Similar to (3), but might be stored elsewhere. Also, you might have to redirect the text pointer if there's no free byte after the original data.