I think NoScript's clickjacking protection works even if the site is whitelisted or you have javascript turned on for all sites, it still checks for XSS type behavior.