Ideally, in your C# code, you only have one method that is (conceptually) "allowed" to call the stored procedure, and that method must live in the data access layer (the only layer allowed to have access to the database connection string).
The ability to actually enforce anything like this at the C# level is pretty lacking. It generally has to be enforced through coding conventions and code review.
At this point, doing a string search through the C# code is probably your only option and I agree it's not a great one. If you can limit your string search to a single C# project, that's great, but not necessarily likely in the wild.
Unit tests are also a decent technique to mitigate some of the risk around situations like this.