It is hard to build a 'child-safe' custom browser, as there is currently no simple way to veto location changes.
While you could scrape the hyperlinks after the page is loaded, and manipulate them, it would be a lot easier if a developer could just specify a 'navigateRequestHandler' callback.
The semantics are simple: unless the callback is set and returns Boolean.FALSE the user can navigate to the new location