(1) Get the sysex manual. That has a pretty good list of what you can control with sysex. (2) I'd have to look, but offhand I don't think there are parameters that you can't access through the front panel. (Not 100% sure, though.) (3) So far as I know, out of range values will not produce much of anything; though the sysex manual isn't 100% correct as far as some of the min/max values. (4) There are undocumented sysex commands, but these will not give you undocumented parameters so far as I have seen.