I would have thought a combination of OpenDNS and a well locked down router would suffice. Coupled with revoking admin rights to the local machine in his room, and preventing it from booting from any media other than the HD, and it would be pretty difficult to get around.
Try a talking to, telling him that you know what he’s been looking at, and that the only way he gets to keep the PC in his room is that you carry out the above measures should work.
Beyond that, the only sure-fire way to stop him is to remove the PC from his room or block his PC from the internet full stop using the router. Even with the BIOS and OS locked down, he could still just flash the bios and boot from Linux off a USB, then tunnel out through a vpn or proxy.