>When I emailed him 2 weeks ago to cancel, and we talked, in that conversation he hinted at sueing me. Thing is, it's only $400.
>
>What would you do?

Have him sign something saying he will delete and remove all copies of the application and will be liable for the entire dev. amount if he doesn't comply (not sure if you can go there and do it for him - that would be the best). Then give him back the $400 and move on. Having him sign something probably won't keep him from using it if he's dishonest, but you can at least use that as a bit of leverage if you ever need to.