Droidwall is the one that will stop any apps you check from accessing the internet.
Ad Free Android is good, since malware can come through ads.
Any custom ROM won't have Google apps. You actually have to flash Gapps separately. I think some alternate search options were mentioned earlier in the thread. If you really want to be hard core, don't even sign in with Google, and side load all of your apps.
ES Security Manager can scan for malware, but I've given up worrying about it, honestly.
"Machete don't text"