For whatever lame reason, ebtables cannot block locally-generated ARPs!
I added in the rules to control on the OUTPUT chain, and they are
ineffective.

So, I added arptables to the ensemble (and added an initscript, since
the arptables package on Ubuntu does not provide one).  This combination
seems to work, although it's only been trivially tested.