You can set the live-set (bank) itself with parameter 09 00 00, i.e. by sending f0 43 1n 7f 1c 02 09 00 00 xx  f7 on Montage or f0 43 1n 7f 1c 07 09 00 00 xx  f7 on MODX(+), where n is the device ID (typically 0) and xx is the live-set number: 0x00 for the preset live set, 0x01 to 0x08 for user sets 1 to 8, or 0x09, 0x0a, … for library sets. You can also query this parameter to request the currently selected live-set. I don't think this is documented in the data list.

As you note, you can switch to a specific slot within a live-set by sending the documented program change message, but I don't know of a way to navigate to a specific page by sysex without switching to a performance slot on the right page, despite this being possible through the UI. I also don't know of any way to query the currently selected performance or live set slot from the instrument over MIDI.

I don't know of anywhere it's documented I'm afraid, other than my (very unofficial) web page on Montage file formats and sysex messages. I found it through rather pedestrian reverse-engineering: just querying lots of likely gaps in the parameter space with a script to see if anything useful turned up.

Other interesting addresses are 0d 00 00 for the song list, 0d 40 00 for the pattern list, 0c 00 nn  for song nn, and 0c 40 nn  for pattern nn. I wrote up some details on the 7-in-8 encoding and chunking for these here.

despite this being possible through the UI

That's what I'm talking... Just try to catch de SysEx message thru a MIDI Monitor but touchscreen interactions are not capture by the monitor.
What I want here is search my next performance thru my live sets but keeping playing the music

The goal of LiveSets is to allow you to put the performances you need together in one place (i.e. one page) so you can then choose between the 16 performances with one button push. It isn't really suited for 'searching'.

Searching a lot here, I was able to change the live set bank using F0 43 10 7F 1C 07 09 00 00 01 F7 where the 01 is the Live set bank number but I'm not able how to change de page

Despite trying, none before you have found a way either.

This reads confusingly at first glance, so allow me to translate for some ...

The registers to control the keyboard have a SysEx ("memory" ) map where each register is made up of a tuple (3 bytes) and the data list documents these as ah, am, and al (address high, address middle, address low).

If we look at only the high address byte (ah) then we see that documentation has the organized Live Set into ah=02,03,04,and 05. There's also this undocumented Live Set Page mapping at ah=09.

And then the leap here or hypothesis (Bill's) is that those missing undocumented values of ah between 6-8 (with Live Set at 02-05 and 09 at the book ends) are somehow related to Live Set.

Now ah=06-08 do not respond to queries at the lower addresses (06 00 00, 07 00 00, 08 00 00) so these are just not mapped at all.

If you want to know where some other undocumented thing live (ah, am, al tuples):

0x64 0x0p 0x00 - (p)art Mute data 0=not muted, 1=muted
0x65 0x00 0x00 - unknown
0x09 0x00 0x01 - unknown (al=00 as discussed previously is known, but no one that I am aware of has described this byte at al=0x01)

and there are various items at ah=0A-0E. Some "discovered" (song file, pattern file, song list, pattern list, firmware version)

The firmware version returned by 0x0B 0x00 al=0x00-0x02 and the rest of the 4 bytes are not "discovered" yet.

0xA0 0x00 0x00 is used by software (the byte is polled). This is unknown what it does. It is unlikely to have anything to do with Live Set. Maybe this is used only for the connection light in software that goes away if this address doesn't respond with 0x00.

No addresses above 0x65 respond at ah=0x66-0x7F am=0x00 al=0x00

The doc shows LIVE SET uses MSB 02,03,04,05 and has tables documenting them.

I'm glad to hear that. I was looking into the Data List and realized that the MSB should be 06 or 07 but wasn't working.

I'm a noob with SysEx and I have lots of doubts but I can deal with that and actually, for now, change the bank using the SysEx that I've mentioned it's awesome for now. If you have any anwser from Yamaha, please let me know

"Now ah=06-08 do not respond to queries at the lower addresses (06 00 00, 07 00 00, 08 00 00) so these are just not mapped at all."

"MSB" is synonymous with "ah" in the context of this discussion. These address ranges are neither documented nor actually implemented -- at least for the given address tuples given above. There is no apparent function for these as no response it given when requesting parameters or bulk dumps.

I did already fish around for addresses beyond just am=00 and al=00. And since am=0x40 is a popular "other stuff" area I specifically tried that already along with am=0x7F and most values with 0 in the lower nibble (am=0x10, 0x20, 0x30, 0x50, 0x60, 0x70).

I don't think there's any there there but, honestly, I didn't "wargames dial" scan the entire range. I've got to think others have done this but it's easy enough to kick off a script and do your own digging independently.