I was going through the manual. Under Custom Search I see no option for Control Channel only like on the XT. I take it there is another way to search for WACN and System ID. Maybe this is now under Discovery Mode?
The HP1, in addition to Discovery Mode, has a feature called Analyze Mode. It's not quite exactly what you want, and it's not in the manual, but it is shown on the menu (on the 436) on the cover of the manual, so I'm hoping it is still included.
I'm going to explain the two (Discovery and Analysis) as they pertain to the HP1, below.. if you already know about them, my apologies, and just scroll past.
Discovery Mode has two different settings - Trunk Discovery and Conventional Discovery. (In the HP1, Limit Search was added here with a firmware update, but I presume the x36 line has it in a separate menu like the x96 line.)
Conventional Discovery lets you set a lower frequency limit and an upper frequency limit, and in that way it's much like a limit search. Where it differs (and gets much better than limit search, IMO) is that you can not only record what you find - which you can with limit search as well - but after you've recorded a pre-defined amount of time on each frequency, it's avoided for the rest of the session. That way you record a certain amount of traffic on a channel, can identify it, and then move on to other channels.
Trunking Discovery works much the same way, except that instead of a lower band limit and upper band limit, you specify a trunk system and site. On the HP1, this has to be a known trunk system/site, and has to be loaded in memory and not out-of-range, not avoided due to your service type selections, etc. So it will listen to all talkgroups and record them, and then avoid them once it's recorded your set amount of time.
Both discovery modes allow for between 30 and 600 seconds (0.5 - 10 minutes) of audio per channel, and you can have it automatically resume searching after 10 to 60 seconds of continuous transmission (so a yammering tow truck driver or a data/telemetry channel doesn't lock up the search). Also, you can tell the session to compare hits to the database if you want - that way if it's a known channel it won't use up recording time on something you (or somebody else on RR) has already identified.
Analyze Mode, at least on the HP1, also requires a "known" trunk system and site, so you can't just search for a signal and immediately come up with the trunking information. However, I have a "dummy" system and site programmed into one of my favorites lists, and I can just change the frequency on the site to whatever frequency the control channel I happen across is.
You can do several neat things in analyze mode. One of them automatically sorts out the LCNs on EDACS and LTR systems, given the frequencies are already at least programmed into the site in some order. Another one will let you watch LCN activity with a colored bar graph that indicates when each frequency is in use - helpful if your system rotates sequentially through its assigned frequencies. But my most favorite function in analyze mode is the Activity Log. That will show you the WACN/SysID/RFSS/Site#, or equivalent in other systems like EDACS and Motorola, and will show channel grants and such as they are transmitted on the CC. If you've ever used Unitrunker or another trunking protocol decoder, this is like that. It's even written to disk and can be reviewed within Sentinel (at least in the HP1; the x36 version of Sentinel doesn't have the Analyze menu, so I'm hoping it's just a bug/omission and it'll be brought back before release).
Having said all that, I just remembered one more thing - on the HP1, if you go into the Advanced menu on a trunk system and hit Site Information, you can then browse all the sites and within each site, tap on a frequency to directly monitor that frequency. If CC data is present and it matches that system's protocol/flavor (i.e. you receive a P25 CC signal while on a system that is set for P25), you will see the WACN, SID, RFSS, Site, and NAC (or, of course, EDACS/Mot equivalents) on-screen. Perhaps the limit search/custom search on the x36 takes that functionality and runs with it, decoding any monitorable CC on the fly?