The other way is to check the cache, and don't allow two different ip address for a single mac address.
I want to start here because this is a very bad idea. There are many situations where a single MAC may have multiple valid IP addresses, especially in an IPv6 world.
Wireshark can detect these kind of activites, and warn us by a 'duplicated ip address' message.
Wireshark is highlighting in these cases a IP address potentially has more than one MAC address in the traffic. This may be a duplicate IP address, but it also may be a valid configuration.
Why doesn't the router act like this? ... I think it is easy to prevent, but network hosts are just let it happen. Why?
It all depends on the router, network and configuration in question.
Many routers will detect and log/alert when there is the possibility of a duplicate IP address. Some routers will not update an ARP entry in their tables until the old entry ages out or is manually removed.
Hosts can be configured to handle this in different ways as well, depending on the OS.
Why isn't there a defense system against ARP poisoning?
There is, it is often called dynamic ARP inspection or DAI and it is present as a feature on many platforms. If you use an enterprise network solution, it is almost guaranteed to be there in some form; it becomes less common as you move down towards SOHO and consumer devices, but can still be found in some, often with simplified configuration and terminology (i.e. there may be a simple check box to enable a number of end point security features).
DAI often works in conjunction with features such as DHCP snooping (which helps to prevent rogue DHCP servers) and works by building a "binding" table between client IP and MAC addresses. If the information provided by an ARP packet doesn't match an entry in the binding table, it is discarded.