As SelfishNet and Netcut use ARP cache poisoning there is not much a firewall can do. ARP is a Layer 2 protocol so the firewall (as a router) is not involved.
The only remedy seems to install a static ARP entry for the gateway, e.g. in Windows
arp -s <IP address of gw> <MAC address of gw>
beside tools like arpwatch which could alert you to changes of IP/MAC pairs.
"Kernel panic: Aiee, killing interrupt handler!"