How can a lightweight client make sure output has not been spent yet?
There are currently 115 or so nodes which will answer the getutxos message.  This is as good a source of this information as calling a 3rd party API.  The problem with both of these sources is that they do not provide cryptographic proof.

It's not actually possible to prove an output unspent, for the simple reason that it may have been spent in a block found an instant after the proof was produced.

The idea of UTXO commitments would have miners publish a digest of the entire UTXO set in every block, which could be referenced to prove that a specific UTXO was unspent as of the lastest one, but you're probably also interested in any unconfirmed spends that are floating around out there.

It may be a better idea to ask your peers to try to prove that an output is already spent.  Only confirmation should build your confidence in an incoming payment, but a spend proof in the form of a conflicting transaction (+ merkle branch, if found in the chain) can instantly lower your confidence to zero.