There are two general means to avoid Insecure Direct Object references.
As @Rook says the best way is Check authorisation on all requests :), that's the correct place to solve the problem.
If, for some reason, you can't do that or you want additional layer of protections you could consider creating an access map, so that the reference presented to the users isn't a direct one and can't be changed to give access to another users data.
To illustrate this concept. Say we have a database ID that goes A1..A10000 which are records for a number of users. When the user logs in or accesses the page that shows them this data we do a database query that returns all the records they should have access to. Then on the server we create a mapping table
1 --> A1000
2 ---> A1005
Then when we give the ID to the user we give them the mapped ID (e.g. 1, 2 ) and not the direct ID (e.g A1000, A1005).
So when a user makes a request to the application they can only request IDs that they have access to and not one's belonging to other users (as the direct object reference isn't exposed..)