You just want to add a check to see if a constant has been defined. If it hasn’t you’ll know the file is being accessed directly.
if ( ! defined ( 'ABSPATH') ) die ( 'No soup for you!' );
Add this to every file you don’t want to be directly accessed.
Also, anything you add (like this) will be erased when a theme is updated — unless you built your own theme and have control over that.