Ok, the basics: 19200bps, 8n1

Commands of the form:

0x01 <command> [<command data>]

Commands are answered with replies of the form
0x01 <command> <result> <command+result>

There's no checksum on commands.
There are 2 special commands, 0xf0 and 0xf1 (single bytes, not prefixed with 0x01)
which tune to frequency A and B respectively - this is for quick switching to do RDS updates.
The tuner acknowleges these by echoing them back.

Other replies from the tuner are:

0x02 <shift> <key> <shift+key>
Stalk response. Shift indicates the shift state of the track skip part
(which can be pushed in, binary 0/1) and key indicates the adc value.

0x03 0x01 0x00 0x01
Overcurrent indication on antenna supply.
Current limit exceeded, foldback in operation.
This indicates a likely short on the antenna output (load <25ohms attached).

command 0: tuner enumerate
1 parameter (0=tuner off/led off, 1=tuner on/led on).
If turned on, result is the tuner id (0x03=am/fm module rev 1) otherwise it's 0.

command 1:
Full tuner setup
8 parameters. Full tuner setup sent to tuner chip (8 bytes).
Result 0

command 2:
Full tuner setup and tuneto
8 parameters. Does tuner setup then resends first 3 bytes with bit 7 of 3rd byte cleared
(unmute audio). Saves frequency as frequency A.
Result 0

command 3:
Tuneto
3 parameters sent as first 3 bytes to tuner. Saves as frequency A.
Result 0

command 4:
read eeprom
1 parameter (address in i2c eeprom to read.
i2c eeprom is inside the canned module and contains antenna calibration values
which are individually calibrated & stored).
Result is the read byte

command 5:
antenna power on/off
1 parameter: 0=antenna down, 1=antenna up
Result 0

command 6:
AM/FM switch direct control
1 parameter, 0=fm/1=am (I think).
Usually, tuneto sets the analogue switch automatically so that the FM-MPX/AM-AF wire
to the empeg carries the appropriate tuner output; this allows it to be overridden
just in case you want to get freaky with the output.
Result 0

command 7:
Force a stalk poll
0 parameters
NO REPLY: well, no normal format reply. You will get a stalk response.

command 8:
set stalk fuzz/stable time
2 parameters: fuzz then stabletime.
Fuzz defines the range within which the stalk adc readings have to stay within
(eg 2 will mean that the reading has to wobble <= +/- 2 from the last ADC read)
for <stable time> loops before it's classified as stable enough to send to the host.
Default is 2/100.
Result 0

command 9:
read tuner module ID
0 parameters
Result is tuner module ID (on rotary dial)

command 10:
read IF counter from tuner
0 parameters
Result is IF counter byte read from tuner module.

command 11:
LED mode
1 parameter, on/off.
If LED mode is set, the LED on the tuner is PWM'ed with relative signal strength - brighter=better signal.
This does not affect any other tuner operation, it's just an installation debug tool.

command 12:
set frequency B
3 parameters, 3 bytes to send to tuner when 0xf1 command is received.
Result 0

command 13: (patrick's tuner only, version 0x28 onwards)
set outputs
1 parameter: low 2 bits control the 2 user output ports
Result 0

command 14: (patrick's tuner only, version 0x28 onwards)
read inputs
0 parameters
Result is state of 4 user inputs in bits 0-3

command 255:
read version
0 parameters
Result is tuner version number. I believe production units are 0x27 (v2.7)

..that's about the size of it! ... The 8 byte setups are very much like the TEA6840 ISTR,
though the chip is a later model.
You really want the UFC1384 module datasheet from Temic.