How to prevent non-image files being uploaded through frontend form?
There is a checkbox when creating/editing the field labeled "Restrict allowed file types?" Checking it will reveal file type options.

Source: https://craftcms.com/docs/assets-fields