I'm thinking maybe Lavender might need updating. with the current 0.6.1
Disabling a particular Navigation doesn't prevent the user to browse its route
As an admin disable the navigation, let's say, Users.
Open an Incognito window and the Users icon is not displayed. Good enough! In the URL bar, type localhost:4567/users and the users page is displayed. In fact, the user should not be able to browse the route even.
These are available in other places. For instance, you can "Hide user list and data from guests" in ACP -> Settings -> User