Unless I'm missing something, there doesn't seem to be a way to set a timeout limit on connections that have been opened by CONNECT requests and where no data is flowing through that channel.
Ideally, the implementation of this feature would (optionally?) ignore any TCP keepalive packets sent through the tunneled connection.