No Free Lunch for Defending Against Prefilling Attack by In-Context Learning