Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation