WPA2 uses PBKDF2 for password hashing; it is configured with HMAC/SHA-1 and 4096 iterations. The result is a 256-bit string. Since SHA-1 offers only a 160-bit output, PBKDF2 needs to apply the iterated HMAC/SHA-1 twice, to get all 256 bits of output, so this means 8192 invocations of HMAC/SHA-1. Each invocation implies two elementary calls to SHA-1 ("elementary call" means "processing of one 512-bit block with the SHA-1 compression function"), so that's 16384 hash function invocations. Once the 256-bit password-dependent key is obtained, a few extra computations are still needed to check that key against what was observed, but that's lightweight so we ignore that cost here (that's about as expensive as a couple more SHA-1 invocations). The whole 256-bit key must be available for that check, so no shortcut here: an attacker running a dictionary attack must pay the cost of computing 16384 SHA-1 instances (plus a few extra code) per password.
An attacker with a good GPU may hope for a billion SHA-1 instances per seconds, so he might "try" 60 thousands of passwords per second -- but that's assuming that he has a good, programmable GPU, and that the software he uses is up to it. Common cracking software like Aircrack-ng will usually be CPU-only, yielding the kind of performance that you observe (1500 passwords per second).
Assuming that you can find an appropriate dictionary (which may be difficult, as you notice, when the target uses Bulgarian words), and know the construction method (as you explain: two words, with capitalization), then you can compute the number of possible passwords (with a dictionary of N words, that's N2 possible passwords) and a simple division will give you the time needed to "try them all".
Without any further information on probability distributions of password components, there is little more that you can do. This also shows that the 4096 iterations of PBKDF2 are effective at making life hard for attackers.
Now, are there any possible shortcuts ? There is a potential shortcut, which is that PBKDF2 uses a salt; it is as if there was not one PBKDF2 function, but billions of billions of distinct functions, one per salt value. IF several access points use the same salt, then attackers who try to break any of these access points may collude and share the effort, because "tried passwords" for one access point will also (somehow) apply to other access points. In WPA2, the salt for PBKDF2 is the network SSID. Thus, if several access points use the same SSID, then they transform the same password into the same key.
However, the actual messages and actual encryption key will be derived not only from the hashed password, but also nonce values which the access points and the connecting client send as part of the initial steps of the handshake (see this answer for pointers). This actually prevents precomputations from being effective. There is a generic advice about not using a "common SSID" but, in the case of WPA2, using the same SSID as many other access points does not seem to induce any extra weakness.
All of the above is about trying to find the access point password, in order to either decrypt traffic, or connect to the access point and benefit from its services (namely, "free" Internet access). No weakness in WPA2 is currently known, making password guessing the only practical break-in path.
However, if the true target is not the access point but another machine which connects to that access point, then other methods may be applicable. For instance, the attacker may setup a fake access point, advertising the same SSID, but requiring no authentication at all; it is possible (depending on the victim's operating system and configuration, and the human user's ability to "click through" warning popups) that the target machine will connect to the fake access point. At that point, the attacker must provide the "Internet access" service, but he also has a direct access to the victim's machine, allowing him to try out any remote exploit relevant to that machine. Also, this puts the attacker in ideal place to try Man-in-the-Middle attacks.