I feel dumb. I was expecting to see AVR's lock bits LB1 and LB2 amongst FUSES in avreal32 programmer, so I never saw that there is a dedicated option for preventing the readback of the chip content.
The command for locking an ATmega168 is (add your usual programmer definition and options):