The EMP discussion is convoluted, and filled with misinformation. There's not much hard info out there beyond the general principles of how EMP's are generated. What hard info exists is mostly classified. As an example of the difficulty discussing the topic, there was a congressional report on the topic a decade or so ago that quite a few scientists dismissed as vague and alarmist. The authors, who themselves were scientists, responded with an answer that could be summed up as, "the detailed information is classified, so we want you to commit to spending billions of taxpayer dollars on private contractors to mitigate this with no way of independently verifying it is actually necessary."
From the more credible discussions I've found of it over the years, the concern for our power grid is more significant from solar storms than nuclear EMP attacks. The latter can not be ignored, but the sun is capable of disrupting the earth's magnetic field more severely and over a larger area than the former. Even so, we're better prepared than the media claims we are - one of the worst solar storm events since the famed Carrington event happened in 1989. It affected millions of people in Canada due to the particular vulnerability of that region, but the overwhelming majority of them got their power back within hours with only a few scattered incidents of permanent infrastructure damage to repair. Another Carrington Event would be significantly worse, but far from civilization ending. The testing the military did (both ours and the USSR) with nuclear EMP's in the 1960's showed real, far from disastrous effects, although the media loves to talk about a single string of badly designed streetlights on Oahu being burned out hundreds of miles away from the detonation. The effects in the USSR were reportedly more significant, because they actually tested over (sparsely) populated areas.
A solar storm is no direct threat to small electronics, but a nuclear EMP is. However, flashlights, with their relatively simple controllers designed for power handling (naturally more robust against the kinds of effects we're talking about than cutting edge processors) and short conductor lengths are inherently one of the less vulnerable electronic items we have around us. And as you observed, the typical aluminum body should actually act as a pretty decent Faraday cage, reducing the intensity of an EMP by several orders of magnitude.
I'm not saying I can prove it is no concern, but I'd be more worried about a computer or smartphone than my flashlights.
Even if a fancy current controlled flashlight might be vulnerable, which I question, a simple LED light with only a current limiting resistor should be extremely robust - probably comparable to an incandescent light.
I seriously doubt there will be very many (if ever) EMP devices set off that are not nuclear bombs (with accompanying radiation) making those whose devices are affected by an EMP either dead or soon dead by a nuclear blast such that only those outside of the blast range would survive long enough to use the "orphaned" devices.
For an effective large scale EMP attack, a nuke has to be set off above the atmosphere. That puts it well out of the range where the blast effects or direct radiation are a significant concern, but the EMP effects can potentially extend hundreds of miles from the epicenter.
Non-nuke EMP weapons (The USAF, for example, has tested a cruise missile payload called CHAMP) would have far, far, far smaller effective ranges. We're talking from a single building to possibly a couple city blocks.
