Today I released the Permissions lock module on drupal.org. This module allows you to have better control over what users having the 'administer permissions' permission can actually configure.
By adding a lock to one or more permissions and / or user roles, you remove that permission / role from the permissions table at admin/user/permissions. Only users who are granted unrestricted access can then change these permissions anyway.