You can still use onclick. The JSF render kit specification (see Encode Behavior) describes how the link should handle it. Here is the important part (what it renders for onclick):
var a=function(){/*your onclick*/}; var b=function(){/*JSF onclick*/}; return (a()==false) ? false : b();
So your function wont be passed the event object (which isn't reliable cross browser anyway), but returning true/false will short-circuit the submission.