I would like to either warn or deny when a host uses an underscore in the EHLO command.

First, set

helo_allow_chars = _

This tells Exim not to reject the EHLO or HELO command immediately. Once you have done that, you can test for the underscore in an ACL. For example, to log a warning for hosts in your LAN, and reject for other hosts, you could do something like this:

deny  message = Underscores are not valid in host names
      hosts = ! +lan_hosts
      condition = ${if match{$sender_helo_name}{_}{yes}{no}}

warn  log_message = Accepted underscore from [$sender_host_address]
      condition = ${if match{$sender_helo_name}{_}{yes}{no}}