This has been discussed before in more depth other places. I'm going to give just a brief overview primer.
You can use a variety of techniques to prevent your VPN from leaking. But nothing is guaranteed. You have to weigh the inconvenience of setting up fail safes, versus the bad things that could happen if it fails.
You could use a container that requires access to the internet through your VPN. So if your VPN fails the container has no network access.
You could use a socks proxy which goes over the VPN, and configure your software to only use that socks proxy. Mullvad makes this easy, not sure about proton.
You could use a operating system like Qubes which would run your software inside of a VM that could only talk to another VM which is set up with the VPN. This is probably the most secure, but also the most inconvenient.
Whatever method you use, you could always run a tattletale program inside of that environment, and if it sees it has a public IP address suddenly, it kills the device.
So everything's a trade-off.