AllowedChars Behavior
The field "Entry" in this stack accepts only the characters in its cAllowedChars custom property. The "AllowedCharsBehavior" button provides the necessary behavior (adapted from Devin Asay's Password Field behavior). To try out the behavior, type the allowed chars in the "AllowedChars" field and click the Set button. (The cAllowedChars is NOT a list of items, just a set of characters, so that any characters -- including commas or other delimiters -- can be allowed.)
To use the field, copy it and the "AllowedCharsBehavior" button to your stack. (You may change the field's name.) Set the behavior of the field to the button's id. Set the cAllowedChars custom property by script or using the Property Inspector.
v2: Changed cAllowedChars to a set of chars, not a list of chars.
v3: Added screening of pasted text (thanks to SparkOut).