Yeah, from what I've read it makes sense that IOS reloading is blocked. I mean, it's the IOS that deals with emulating the wiimote (and even initializes the gamepad so it doesn't freeze), so reloading to a regular IOS doesn't seem like a clever choice.
The core wiimote emulation is (in HAIOS v 0.9, I believe it came from Xenoblades) on OHCI1:138B3150. It gets the HID payload in r0, cmd in r1 and r2 is true when DRC (gamepad controls) is enabled.
As you can read on
http://wiibrew.org/wiki/Wiimote#Data_Reporting, there are several modes you can query the wiimote with. The thing is, HAIOS makes a decision about whether or not to emulate the classic controller based on the data reporting mode. The current mode is stored at LOAD:138BA020. The report format is prepared (and buffer size checked) by OHCI1:138B2F48, the data itself is generated based on it by OHCI1:138B2D90 (CreateDataReport).
Basically what I did last time was to patch it so that the data reporting mode is 0x30 (Core buttons), in which case the HAIOS emulates a wiimote and not a classic controller. Just by modifying the OHCI1:138B2D90 (CreateDataReport), you can basically modify the button mapping to anything you want (even for wiimote held sideways etc.).
Oh, and also, the GamePad data is read by OHCI1:138B298C (readGamePadData). It seems it reads just the buttons. It needs to be modified in order to read the acceleremeter. And god knows if it's in any compatible format.
If there's anybody with knowledge in IOS developement, it might be very helpful to be able to show 8 bytes from LOAD:138BD4F0 on screen all the time (it's the complete state recieved from the GamePad).