Yep, thats' the clamping diodes, most mcu pins are like this:
Simplest way is to just put a 100Ohm resistor to the VDD rail, the clamping diodes will dump the current into it.
Not good for battery powered because that will cause permanent VDD current consumption when ON.
For more power-critical circuits, you can use this simple circuit.
When VDD is present, Vb >= Analog input, so the transistor can't turn on, there's no extra current consumption.
When it's gone, VDD itself goes near 0V providing a path for the base current flow.
Anything >0.7V will turn on the transistor and clamp the voltage. 0.7V shouldn't cause any problem.