I think that the xrdp.ini parameter that controls the listening interface IP is called 'address' not 'ip' i.e. in the globals section:
[globals]
address=127.0.0.1
At least, this works for me - however note that I am using a source-built xrdp from http://scarygliders.net/x11rdp-o-matic-central-downloads-page/ so I can't guarantee it is supported in the default packaged version.
The closure of the port can be confirmed by running netstat on the remote host, or using nmap i.e. before adding 'address=127.0.0.1' to the [globals] section:
$ sudo nmap -p 3389 192.168.1.16
Starting Nmap 5.21 ( http://nmap.org ) at 2013-08-05 02:08 UTC
Nmap scan report for 192.168.1.16
Host is up (0.0065s latency).
PORT STATE SERVICE
3389/tcp open ms-term-serv
After adding the 'address' parameter and restarting the service
$ sudo nmap -p 3389 192.168.1.16
Starting Nmap 5.21 ( http://nmap.org ) at 2013-08-05 02:10 UTC
Nmap scan report for 192.168.1.16
Host is up (0.030s latency).
PORT STATE SERVICE
3389/tcp closed ms-term-serv
Also note that at least in Windows 7, the native Remote Desktop Connection client appears to have trouble if the remote server is tunneled to localhost:3389 (the default xrdp port), I ended up setting my putty tunnel as
L33389 localhost:3389
and then specifying localhost:33389 in the Remote Desktop Connection dialog (although any suitably high numbered free port should work as well)