How to deny access to invalid $_GET parameters
There's no 'catch-all' method for this sort of thing, but on an individual basis you would probably want to perform a manual check in hook_init() in a custom module:

function MYMODULE_init() {
  if (isset($_GET['page'])) {
    if (!is_numeric($_GET['page']) || $_GET['page'] &gt; 9) {
      drupal_access_denied();
    }
  }
}


I imagine you'll need to add further conditions to the above code to make it more contextual to your specific situation.

EDIT

As MPD mentions it might be better to use drupal_not_found() in place of drupal_access_denied()...it's a better semantic representation of what you're actually doing.