Well, if you don't want to go to Bromo. You probably want to skip east java (Surabaya, Malang) and go straight to Yogyakarta.

I'll just list the place to visit in Java,

East Java:
Kawah Ijen - Active volcano crater, 2 hour hiking trip, 8 hour drive from Surabaya, near Bali. They do have half hour flight Surabaya-Banyuwangi which would cut your time. You should be able to visit watu ulo beach n sukomade beach (seeing seaturtle laying eggs)

Bromo
Madakaripura waterfalls - near bromo

Sarangan lake - near the border between east java and central java, you can hike to mount lawu when you're there.

Central Java:
Borobudur
Prambanan
Dieng Plateau

West Java:
Tankuban prahu crater
Kawah Putih crater