How to prevent non-image files being uploaded through frontend form? Is this possible? At the point of upload, the entry field isn't checked so anything can be uploaded, which is a bit worrying.

Then again, if it's an Amazon S3 bucket, does it even matter? It won't be sitting on the server.
There is a checkbox when creating/editing the field labeled "Restrict allowed file types?" Checking it will reveal file type options.

Source: https://craftcms.com/docs/assets-fields