I have found that observing the execution of the code helpfull by looking for execution of jump and ret (& reti) instuctions. this can be done by connecting a logic analizer to the address bus when there is an external ROM or by using a simulator or chip emulator. IF neither of these options are available you could try dissasembling code by following the instuctions starting at the fixed reset and interrupt vectors