The following interface messages seem to be treated as raw HTML in MobileFrontend, but aren't listed in RawHtmlMessages:
There are probably more. I created this list by adding an <img> to every single MediaWiki page corresponding to the MobileFrontend /i18n/en.json, randomly clicking on buttons in the mobile editor, then grepping apache logs for .jpg requests. I'm sure I haven't displayed everything, yet.
MobileFrontend may also be treating some non-MF interface messages as HTML; I haven't looked yet.