I would have put a peltier/TEC below the thermostat to influence it's measured air temp vs resorting to reverse engineering and illegal signal broadcasting.
If you bought such a thermostat in the US (e.g. at walmart or what-do-I-know), that device would probably operate on 433 or 915 MHz. I think you can legally broadcast on these in the US, much like the OP did [in the UK]. Power limits might be a bit different and such. But IANAL and no US person, so do some research before grabbing a HackRF One ;-)