path to is in Standard Additions and it must launch the app to get the return value (with the exception of some of Apple's apps-- see for example TextEdit). One idea is to query the Launch Services Registry, which has records of all executables, and the use grep to pull the path that matches the app name you're specifying. Something like:
getAppPath("TextEdit.app")
on getAppPath(appName)
try
set launchServicesPath to "/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister"
-- get the path to all executables in the Launch Service Registry that contain that appName
set appPaths to paragraphs of (do shell script launchServicesPath & " -dump | grep --only-matching \"/.*\\" & appName & "\"")
return appPaths
on error
return "NOT INSTALLED"
end try
end getAppPath
Note that this can return a list of paths, since there could be more than one executable with a matching string app name. So, you'll want to account for that.