You can only do this securely on the server-side. Using the "accept" attribute is good, but must also be validated on the server side lest users be able to cURL to your script without that limitation.
I suggest that you: discard any non-image file, warn the user, and redisplay the form.