You can write your own kavascript that will check the characters and disable the send button.
If you modify the controller, the filter will not work. Prestashop 1.6 is not secure.
https://e-apps.eu/en/domu/54-antispam-protection-for-contact-form.html