Usually, if you do not provide a path option for them, such as file_select_ex, then the user is forced to accept your path selections.
1) Prompt them for the "save to:" filename (not path)
2) Allow all characters as input except those that could be perceived as a "change path" character (/ or \\, etc.)
3) When they're done typing, you can do some extra stripping of the characters and ensure that the page that you specify, like SAVE_DIR, is the same that you will be saving the resulting BITMAP (or filename, or whatever) into. If it is, save as normal. Otherwise, strip off all "extra" characters.