Since the default code just uses PWMs 1 and 2 for the camera servos, you should be able to just read the values in directly from the pwm01 and pwm02 variables at any point in the loop after the Camera_Handler() function is called.
As for knowing if the camera is locked on, you can use the camera confidence value - the higher it is, the more sure the camera is that it is locked on to a target. There's a predefined threshold macro (its default value is 20), so you can just do something like this:
Code:
if (T_Packet_Data.confidence >= CONFIDENCE_THRESHOLD_DEFAULT)
{
// locked on
}
else
{
// searching
}
Edit: Alternately, you can call the Get_Tracking_State() function, which will return SEARCHING, TARGET_IN_VIEW, or CAMERA_ON_TARGET.
I've never used the camera menu, so unfortunately I can't help you with the last point.