IMHO - I reproduced the issue you are having on one of our systems except for the use of Claims authentication. My search account does have 'Read' access for the web application. A list was created and anonymous access was initially enabled from inheritance. The search index was already built (it is scheduled to run often) and could query the list as anonymous. Then I removed anonymous access from that list and ran an incremental crawl. I was still able to get results from that list (now restricted content) as an anonymous user, but got the login prompt when trying to access via results.
I then did an index reset and after the rebuild, attempted the same query I did before and no longer saw the 'restricted content'. I could still find the 'restricted content' with an account that does have access to the list.
So I believe you could reset your search index and then do a full crawl and the results should be trimmed correctly. As always, I would recommend you test on your system and understand the implications of an index reset.