Full usage map?

Having added the FastROM patch into Parallel Worlds, I've started looking into tracking down all of the new PW-specific code paths that could be added to the patch list.  I'm not sure of a good way of scripting this.  I tried doing a naive scan through the ROM file with the following logic:

Find all bytes $22 (JSL) and $DC (JML)
-Read the following 3 bytes
-Check if it might be a valid LoROM address (value & $8000 != 0)
-Check if the address would be within the ROM size ((value & $7F0000) >> 1) | (value & $7FFF) < filesize
-Skip if it would be a FastROM address (value & $800000), if so skip (I'm running this on the FastROM patched ROM)

Logging everything that matches those 3 rules gives me 1,351 potential matches. Any thoughts on how I could narrow down my parameters any more, or else does anybody have a full (or at least decent) usage map for the game, in the direct binary form like what Geiger's debugger or bsnes+ outputs? I have both MoN's and wiiqwertyuiop's full disassemblies but that still doesn't solve the problem of manually going through everything. Yes there will be differences between aLttP and PW, but at the very least I can make a few assumptions like ruling out regions marked as data in aLttP.

If nothing else, I can probably do some creative grep-ing in wiiqwertyuiop's disassembly for all instances of bytes 22 and DC that are something other than a jsl/jml instruction and build an ignore list out of that...

Well, I managed to get the list down to 300. Maybe I'll just try it and see what happens...

Ok, out of that 300, large contiguous blocks were quite obviously data blocks, so I've been able to narrow it down to 70 that I'm pretty sure about and another 30 that look like they're probably data. That's probably feasible in terms of manually disassembling those locations and seeing if it looks like code or not.