To be honest I hadn't found a solution yet - I just went around smacking fingers with my wooden spoon like my Grandma used to do when we ate with our fingers. There must be a better solution that will cut down on the HR complaints.
All kidding aside, I have them fairly well trained now not to touch anything on the regular menu and to only update their "My Tasks" so it's accidental at this point, and usually all they've done is move the item into a different folder. I tried excluding permission for the Menu Upgrade Utility but my test user was still able to move, delete and rename menu items. That's what I would be trying to restrict.
Good luck!
