Can a 2 of 3 multisig transaction signature be revoked before it gets confirmed by the miners?
The problem is that you can't broadcast just a signature. You can only broadcast a complete transaction with enough signatures to make it valid. Likewise, there is no way to revoke a signature. The only way to "cancel" a transaction is to broadcast another transaction which spends the same input as the original transaction. After that, there is a chance that the new transaction will be confirmed instead of the old one.

There is no point in having 2-of-3 address if there is one person who has 2 keys. That person can spend any money from such address, and the person who has the third key can't spend anything without the other person's assistance. In your scenario, Bob can double-spend his payment before it is confirmed by using both of his keys.

To solve the problem, you need to use such an address that Alice's signature is required to spend from it. For example, 2-of-2 address will work. To make sure that Bob can have his money back if the deal doesn't go through, you can use the approach described here.