Efficient but Vulnerable: Benchmarking and Defending LLM Batch Prompting Attack