You would update the recordset on the members_update.php page so that it filters with the url parameter for the memberID but also filters by the familyID from the session.
That way if they change the url parameter to another member in their family it would work, but if they try to change it to a member from a different family it would bring up a blank page or error message since no result would be found.