I'm helping a friend of mine who wants to install a Panamax GPP8005
whole house surge protector, which gets mounted next to the main
panel. The instruction say it can be connected to the main panel
using either a double 30 amp breaker or preferably using a sub-feed
lug kit.

The picture of the unit shows it with wires coming out, ready to be
attached. So, I understand the connection method using the
breakers. But, if we followed the directions and connected it using
a sub-feed lug kit, wouldn't that be a major code violation? The
only protection then would be the main panel 150 amp breaker, which
would be incompatible with whatever gauge wires are coming out of the
surge protector, because if they can connect to a 30 amp breaker, they
surely can't handle 150 amps. So, am I missing something here?

Here's the install instructions and pics if you want to look:

http://www.smarthome.com/manuals/4839_new2003.pdf