First things first, disassembly time! In the picture below we can see the different components making up the hoverboard. We can see two gyro boards, one main board and the battery.
Each gyro board contains a Cortex-M3 processor calculating its orientation from an MPU-6050 accelerometer/gyro sensor and sending it over UART to the main board, which is responsible for both driving the motors and charging the battery.

Thanks to Drew Dibble's work we know that the UART lines run at 26315baud, with 1 stop bit, no parity and LSB-first. In the pictures below we see the serial bus and the IR sensors used to check if the user is standing on the board, which we will spoof with a bit of tape.

Using a logic analyzer we find, as Drew explained, that the instructions follow a pattern of six commands: 0x100, 0x0aa, 0x0bb, 0x0aa, 0x0bb, 0x055. The first command marks the start of the instruction, and the last is 0x055 if both IR sensors are blocked.

We captured data at various inclination angles in both directions to find out the values of the middle bytes. The table below shows the data being sent by the board when increasing the angle. For example, if the board is tilted a few degrees forwards, it sends the sequence 0x100, 0x053, 0x000, 0x053, 0x000, 0x055, which can be seen as 0053h or 83d.

As we can see, when moving forwards the values go from 0 to over 5k, while going backwards the values would go from 65535 to about 57k.

Armed with this knowledge, we can easily map the input of a potentiometer to the range of speed desired, and control the motor from our favorite dev board!