I can't seem to find a way to, for example, lock down Lua's file IO functions,

That is easy, compile lua.dll without the file/io extension :)

Or undefine io  io = nil; but you have to disable  require('io'); with  require = nil ...

It doesn't matter much which API you use, you setup your lua sandbox, then call runcode $userinput -- read/combine these :)

• http://lua-users.org/wiki/LuaSecurity
• http://lua-users.org/wiki/SandBoxes
• http://www.corsix.org/lua/bytecode_abuse_0_1.lua
• http://stackoverflow.com/questions/5097993/lua-sandboxing-eliminating-function-creation
• http://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox
• http://stackoverflow.com/questions/966162/best-way-to-omit-lua-standard-libraries
• http://www.tecgraf.puc-rio.br/~lhf/ftp/lua/#demo
• Re^3: Embedded scripting sandbox? Lua?
• http://luadist.org/