Once you configure the menus the way you want you can change the permissions on the menu config file so the children can't mess it up. You can take ownership of it and give the children read and execute permission. Something like this:
chown -R admin_account:target_account /home/target_username/.config/menus
chmod -R 744 /home/target_username/.config/menus