escaping tn5250 in a locked down environment

Hello,

I am going to replace some twinax green screen AS400 terminals with tn5250
under Debian Stable.  Tn5250 is great, and this is a good way for me to
recycle some "obsolete" PCs.  Are there any "shell escapes" or any other way
the user could break out of tn5250 and execute external commands?  I want it
locked down as much as possible because my users will mess with it, and they
only need access to the AS400, not the Linux environment.  I have Debian
locked down pretty good, I'm just concerned about the actual tn5250 program
itself.  I have tn5250 set to run with su in /etc/inittab and all gettys
disabled,  and I can logon remotely with ssh - the monitor shows nothing but
the AS400 logon, hit Ctrl-Q to quit and init takes care of running tn5250
again.

Thanks,
Josh