There's no "silver bullet" that will cover all concerns, but one simple step that might help is to use OpenDns as your DNS provider in place of your ISP's DNS servers. It's easy, free, and appears to have little downside.
Whenever the MBP requests the DNS server to translate a domain name to an IP address, OpenDns will block access to "undesirable" domains. Optionally, you can use their OpenDNS Updater program to notify them of your current IP address. Then you can create a (free) account and have a fair amount of control over which sites are blocked and which are not. You can see recent stats on what domain addresses were requested. Check it out (opendns.com).
Easiest is to have all devices on your home network use OpenDNS by setting it in your router/gateway device (since normally devices on your local network get DNS server addresses from there), but you could also set the OpenDNS servers on just your son's MBP, leaving your other devices to continue to use your ISP's default DNS servers. (To do that, go into the MBP's system preferences-->Network-->Advanced-->DNS.)
My approach was to tell the kids upfront that if they got a "blocked" message, not to worry about it, but if it was something they thought they should be able to see then to come to me and I could check it out and unblock that site.
I think OpenDNS is pretty useful, but it certainly doesn't address every accidental, shocking, premature discovery. On my particular concern list is Google image search. You should know that by default "SafeSearch" is not enabled, and no DNS filter will help you with this, assuming you want to allow access to the google.com domain at all. Be careful what they type! You can go to every browser, on every account, on every machine, on your network that they might use, and set "SafeSearch," but what a hassle! And here we're just talking about more or less accidental exposure -- the setting (even if "locked" with a google account and password) is just saved in a cookie, so if the older computer-savvy kids want to get around it... well, that's a whole different discussion...
I think OpenDNS and "SafeSearch" probably block a lot of stuff I wouldn't really feel the need to block from my kids, but there is for sure some stuff I would like to block from them, at least for now, and well, these overly-blunt tools are at least quick and easy...