Add the [L] flag to the end of the rule.
Adding a $ end anchor to the pattern will force three or less.
There's a potential problem when only one element is present. Will it match the first pattern or the last pattern? Will it do that on all servers, and Apache versions? Could it change after a server upgrade?
Another problem comes from the * in the
pattern, and the optional slashes mid-URL. A request like
is perfectly valid (but highly undesirable) with your rules.
I think I would use three rules, with one, two and three fixed patterns.
Don't make the trailing slash optional. Either require it, or require that it be omitted, otherwise you're introducing yet more Duplicate Content issues.