By making it far more costly an attack to perform, and by giving the coinjoin transaction the ability to overcome the blockage.

At present, Carol can attack by broadcasting a non-RBF transaction at 1 sat/vbyte. It doesn't matter what fee the coinjoin pays; the malicious double spend will not be replaced. With full RBF, Carol must be willing to pay a much higher fee. If she only says 1 sat/vbyte, then the coinjoin can be bumped to an equivalent of 2 sats/vbyte and displace her malicious double spend. Further, at present, Carol can leave her 1 sat/vbyte transaction in the mempool as long as she wants, and let the coinjoin operator repeatedly attempt to bump the coinjoin with a higher and higher fee, with effectively no limit (other than the limit of what the participants would find acceptable). With full RBF, the coinjoin operator only ever needs to bump the fee as high as the fee on Carol's double spend.

I don't see how you could. By the time you come to punishing Carol for it, she has already achieved what she wanted to achieve - wasting the time and/or money of the other participants.