Okay, then there is several options you can do to really fix the CFileDialog. The following alternative uses MFC's CFileDialog (since that seems to be what you want to use), but you could just as easily use the method that it wraps, GetOpenFileName. First, create an instance of the CFileDialog. When you've done that, get the m_ofn member struct from the instance and perform the following.
OR the Flags member of the OPENFILENAME structure with OFN_ENABLEHOOK. You might also want to OR it with OFN_NODEREFERENCELINKS while you're at it to keep users from making a shortcut to a location outside your limited scope.
Set the lpfnHook to a HOOKPROC callback.
From there, your options are many. In WM_INITDIALOG, you could simply remove the the "Up" button entirely based by getting the toolbar in which its contained (based, perhaps, on the window class for the toolbar which Spy++ can give you, which is ToolbarWindow32, or getting it based on the tooltip or some other identifier) or handling the message generated when you click the up button. Spy++ reports this as either WM_USER+300 (aka 1) or WM_USER+302 (aka 2) (both were posted as 1211 (based on aforementioned aliases). What those mean you'll have to dig-up. All the other messages were mostly painting and mouse messages - nothing that would seem to help. It's surprising that handling the click messages and returning true didn't help. Did you handle WM_LBUTTONUP? That directory change is triggered then and not during WM_LBUTTONDOWN. Just out of curiosity, how did you determine if the "Up" button was being clicked?
-----BEGIN GEEK CODE BLOCK----- Version: 3.21 GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++ -----END GEEK CODE BLOCK-----