Nope, it is impossible in code "as is".
It requires a bit of trickery.
You could hack it to select a tunnel to assign
all not classified IPIP packets to it f.e. to hook netdev notifier
at ipip.c, catch the moment when the first tunnel goes up
and select it, or catch when tunl or tunl0 goes up, and
until this moment drop all such packets. Ugly.
Beware, if you just deleted ip_find_tunnel, firewall would
not able to segregate packets arrived from tunnel and normal traffic.
Alexey Kuznetsov.