one thought would be to make use of the fact a tower in range would be transmitting intelligent data, so by partially decoding and testing that it fits the protocol, would cover all broadband noise jammers,
the next would be that its very rare short of out in country for there to be only 1 tower in range, so you would check that there are more than 1 tower in range, an intelligent jammer would only act as 1,
third tier would be to possibly use some echo command on the cellular network, i would assume even without a sim, one command or more would return a n_ack or even spoof an ID and see that it returns false, or possibly have a working set and see that it returns true,
these methods i think would cover 95% of attacks, first for noise, second for intelligent jammer, third and forth for a rouge node attack, (doesnt jam but rather acts as a node that doesnt work)