The next source are graphics Regions and RegionRectangles, unfortunately this is much harder to fix in a conservative backwards-compatible way.
Make graphics.library allocate this stuff in such a way that their addresses are multiple of 2, but not multiple of 4 (ie. address last byte is 0x2, 0x6, 0xA or 0xE). This way it should be possible to detect if it was allocated by itself or by someone evil outside.