You could add an ItemUpdating
handler and just cancel out of future update operations with a sensible error message for the user. That makes it a little goofy, though, because you're still giving them an opportunity to attempt to edit the item before slamming the door in their face.
OTTOMH, you might want to declare a custom edit form in your schema.xml file for your list definition. For the edit form, you could direct to a custom application page that would assess the editability of your item. If the item is editable, it redirects to the regular edit form. If it's not editable, it shows the sensible error message.
Unclepaul84's idea is good, especially if you want to make sure that the user doesn't even see the "edit" menu for an item. You would have the responsibility of going through any existing list data and applying those security settings, and if your rules change, you will have to go back and re-apply the correct settings. This might not be a big concern for you, but if your rules might someday change or if your rules are really more dynamic in nature, I think intercepting the edit form might give you better mileage.