TL;DR
Pivotal Tracker uses a rather simplistic permissions system that doesn't provide fine-grained technical controls. Process controls you impose on the the use of Pivotal Tracker by users with "member" or "project owner" permissions will need to be administrative rather than technical.
Pivotal Tracker Has Open Permissions by Design
In the question, the original poster (OP) says:
It would be beneficial if only the Product Owner could move stories from the Icebox to the Backlog.
Pivotal Tracker supports only three levels of permissions: project owners, members, and viewers. It doesn't seem to support finer-grained permissions, and apparently this is by design. One Pivotal Tracker representative has said:
Tracker is used by many diverse teams, and it would be difficult for us to come up with a permission scheme which would satisfy everyone, and justify the additional complexity (we like to keep things simple).
So, our philosophy is that these different roles for project members should be something that is agreed upon and communicated within your team (because communication is good!). If there are only certain activities which should be performed by project managers, this can be communicated to all team members. If someone makes a mistake, it is easily reverted in most cases by looking at the project history.
Short of making someone a "viewer" with read-only permissions, there is currently no way to restrict someone's activity within Pivotal Tracker in the way the OP describes. Any process controls imposed on the the use of Pivotal Tracker by users assigned to the "member" or "project owner" roles will therefore need to be detective->administrative rather than preventive->technical in design.