I am currently listening for EntityDamageEvent and in the case that either of these is true:

entityDamageEvent.getCause() == EntityDamageEvent.DamageCause.ENTITY_EXPLOSION
entityDamageEvent.getCause() == EntityDamageEvent.DamageCause.BLOCK_EXPLOSION

I am canceling the event. Despite this, primed TNT and creepers still destroy entities (e.g. boats) and knock back entities (e.g. falling blocks). This can be abused in the case that a player manages to launch TNT or lure a creeper into a protected area, thus causing destruction of various entities that would otherwise be protected from a player simply punching them.

Additional Note: WorldGuard is also unable to protect entities from explosion. Of course, blocks are protected by canceling EntityExplodeEvent.