Okay, my explanation is somewhat over simplified because this is actually a
very complex matter which the GSM standards also give some latitude to the
handset manufacturer. There is also a difference between automatic selection
and manual selection, plus the subscriber is normally allowed to edit the
preferred list of Public Land Mobile Network (PLMN) stored in the SIM.

The important points are that the home PLMN is a special case which the
handset must search for on power up; If this is not found than, and only
then can it consider alternative PLMN (sometimes referred to as VPLMN). When
a GSM subscriber signs up for roaming, a SIM update is normally sent to the
subscriber's equipment. This will normally update the list of preferred PLMN
(which will also include the Home PLMN) and a list of forbidden PLMN. But as
you correctly pointed out, it will be impossible to maintain such a list as
new agreements could be constantly set-up and terminated. So the equipment
also self-learns which network it can work on by the location updates during
roaming. If a VPLMN rejects a location update from the handset terminal this
is added to a list stored in the handset (and not the SIM) so that it will
not attempt to access this VPLMN again.

But this presents a problem, what if some time later an agreement is set-up
with this VPLMN? The standards do not deal with this and this is left to the
equipment manufacturer to deal with. Anyway, I think this simple explanation
describes briefly how it all just about hangs together!