No, they can't, at least not in bitcoin-qt:  when the user pokes the SEND button, the transaction is broadcast on the network, and then the merchant is also told with the Payment/PaymentACK round-trip.

Allowing merchants to cancel (e.g. having a PaymentNACK) makes implementation harder, and brings up nasty issues if we want to allow CoinJoin or CoinJoin-like transactions as payments to merchants.  Bitcoin-Qt ALREADY allows you to pay several PaymentRequests with one transaction; handling the case where one merchant gives you a PaymentACK and another gives you (or wants to give you) a PaymentNACK is a nightmare.

--