If ESC i.e.'\033' is forbidden, you may also want to forbid CSI i.e. '\233' which was treated at a short version of "\033[" in VT200+ in 8 bits mode.
The trick is to set the name of the terminal to "sudo rm -rf /" and then ask the terminal name, but that is not supported by most terminal emulators.
Also, could forbid XON/XOFF writing to the console, if filtering is needed.