It's impossible (for you) to stop the threat before the modem, as this is what demodulates the physical signal such that it can be interpreted by the rest of your network (LAN).
However, you could use a hardware firewall between your modem and your router if you wanted. These do offer more security, of sorts, because you can apply very strict rules to this device which can't be modified in the same way that a software firewall on your PC can be (malware with admin privileges can simply turn it off..)
The trade off you have to make is the installation, configuration and maintenance of this device. If you aren't familiar with firewall utilities such as iptables you may find it very difficult to configure it such that you have the flexibility you desire without compromising on security.
If you have broadband internet then you almost certainly have a NAT-router which acts as a hardware firewall in its own right (doesn't allow unsolicited packets to enter your LAN). This is good enough for all but the most security conscious users.
Given all of this, if you do want to give it a try I've heard good things about ASTARO appliances, which if you have an old PC knocking around you could download and run their free home hardware firewall virtual machine appliance. I've never used them myself but they are very well respected in the security world.