Prevent Privileged User from Denying Access to SA
SA is a login just like any other.  You may want to do some research on best practices regarding the SA account.  It does not need to have superpowers.  

Members of the sysadmin role, however, cannot be locked out of anything and members of this role bypass security checks.  If SA is a member of sysadmin, there shouldn't be anything you need to do.  

A programmatic approach could be to create a SQL Agent job that restores the correct (according to you) memberships for administrator accounts.  Set this to run on a schedule and you're guaranteed to have the permissions restored (unless UserA decided to mess with the job).

However, this is really more of a personnel issue.  The people that have this level of permission on a server should be experienced and trustworthy enough not to mess with the administrative level permissions.  If they don't know what they are doing, they should not be able to do it.  If they know what they are doing and do it any way, you have a different problem.  This may best be handled by a business policy indicating that anyone that messes with administrative level permissions may be subject to disciplinary action.