Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate.
You can symmetrically encrypt communication data and store the key in the client then use obfuscation to make access to that key and encryption algorithm harder. And you can also protect the obfuscation by making decompilation harder. An example flash obfuscator and anti-decompiler is SWFencrypt and BISguard.
The previous are static source code protections but they don't guard against live/dynamic attacks. One way of protecting from these attacks is for the client to use integrity checks on memory and resources. There are also some anti reverse engineering techniques that can make live debugging harder.
The other way to prevent against live attacks is to use software that looks for any system tampering that may be used for client software tampering. This is the realm of rootkit-like anti-cheat engines like Punkbuster, Warcraft's Warden and Valve's VAC.
A different kind of protection is code signing and memory signing (down to the memory page) on closed platforms like iOS and Android. This way, you can limit static modifications to the client's binary and dynamic ones to its memory and the OS.
Even the old CAPTCHA can be used as protection against automation but it hurts user friendliness. You can also detect automation on the server, through user behavior and usage patterns then couple it with CAPTCHA to reduce false positives.
Aside from technical protections, you can use with legal means and even incentives. Provide the best client so users won't be inclined to hack yours or write their own. Or make it so that a custom or hacked client won't give the hacker a far greater advantage. Legal means are not my strength and will vary by country, but I've heard about lawsuits on reverse engineering. Legal threat might deter companies and individuals from selling or providing custom clients.
Finally, you can turn the whole problem on its head and make the webservice easily accessible through flexible APIs and protect against abuse on the server. You might also charge small fees for the superior functionality your hackers are craving for. :)