The trouble here is not with inputlookup but rather with subsearches. Those are evaluated first, and the main search is launched after that.
You could define your lookup as a regular automatic lookup and filter based on that. Might degrade search performance a little, but should work with realtime searches. Say your lookup contains a list of IPs, add a field whitelist=1 to each and search like this:
source="/var/log/httpd/vhost.log" uri_query="*bad_keyword*" NOT whitelist=1 | top ...
Didn't test whether this handles reloading a changed lookup file though.