Hacker News Reader

MAC filtering is useless, even in combination with WPA2. An attacker only has to sniff for a MAC your AP is happy to talk to and then changes theirs.

Is there a way to lock down a router in a way that can't be so easily spoofed?

The best thing you can do is make sure your WPA2 password is totally random and long. Everything else is icing or next to negligible importance.