You'd have to parse the cells as some sort of DSL that only allows mathematical tokens, as opposed to eval which allows access to the full arsenal of the JS language. But I think excel is Turing complete
Brings up the interesting question -- I wonder what turing-complete DSLs have drop-in JS libraries you could use to replace the call to "eval" here.