The primary menu pointers are stored in code for each menu page. They are loaded into the X register prior to jumping to the routine at $C2/ED31.
Menu Background Packets
Background Packets are a series of commands for menu drawing. All commands are even numbered. 08 must be called first, or behavior will be unpredictable. A negative value (0x80 or greater, 0xFF in existing menus) ends the packet.
00 S2 S1 D2 D1 - Fill S1S2 bytes with D1D2 data. Mostly used to clear parts of the screen. 02 X1 Y1 X2 Y2 WW HH - Copy tiles at X1 Y1 to X2 Y2 WW width, HH Height. 04 TT TT XX YY WW HH - Draw box with tile TT TT, upper left at XX YY, width WW and height HH. 06 P2 P1 XX YY UU - Draw text packet P1P2 starting at XX YY. UU unknown. 08 D2 D1 - Set destination D1D2. Can be used to specify what background layer is being written to, or other options. 0A ?? 0C MM DD BB PP - DDMM - DMA channel choice. BB - B address data. PP - Paremeters. 0E AA AA - Address (bank $FF) of data packet to copy. First byte is length. So far I've only seen this for shading.
Menu Text Packets
Text Packets are used to display foreground information. Usually this is text, but some icons are loaded this way too. 00-0F are special purpose, and 10-FF are characters.
00 - End Text Section 01 - Linebreak 02 VV VV - Add Value to current text position. VV - Value to add. 03 R2 R1 SS BB - Load base 10 value for display. R1R2 - Ram address to load. SS - High nybble: Digits - 1 (Max 7) Low Nybble: number of bytes to load from RAM (Max 3) BB - Bank for RAM Address 04 P3 P2 P1 - P1P2P3 long pointer (jump to new command) (4 bytes) 05 R2 R1 - Print Text from RAM. R1R2 - RAM Address 06 R2 R1 - Set palette from RAM. R1R2 - RAM Address. 07 R2 R1 - Print character from RAM. R1R2 - Ram Address to print. 08 CC - Print whitespace. CC - Number of spaces - 1. 0A VV - Set Palette 0C CC R2 R1 - Load base 10 value for display with cap. CC - Cap for stat, max 99. R2R1 - RAM address to load.