Once you establish a particular look and feel and you don't want users with lots of permissions to mess it up, you need to lock down themes. If you don't want to do anything stupid like mess with the page in _layouts and you don't want to add screwy code to look for the themeweb.aspx you can do it a simple way ...
For the site scope where you want to disable it, run from the SharePoint Management Shell (not valid for SharePoint Foundation):
Disable-SPFeature -identity enhancedtheming -url http://hostname.net/sitename
Then delete all the themes from the gallery. Done.
I will be monitoring the fallout from this as we move to QA, but this seemed obvious!