Menu module shows all categories, even disabled

Indeed. Please change the line:
$query = 'SELECT * FROM '.hikashop::table('category').' WHERE category_parent_id IN ('.implode(',',$ids).') ORDER BY category_ordering;';

by:
$childsFilters = array('category_published=1', 'category_parent_id IN ('.implode(',',$ids).')');
hikashop::addACLFilters($childsFilters,'category_access');
$query = 'SELECT * FROM '.hikashop::table('category').' WHERE '.implode(' AND ',$childsFilters).' ORDER BY category_ordering;';

in the file components/com_hikashop/views/category/view.html.php
That fix will be added to next version of HikaShop.