To fix both problems, I'd suggest:
RewriteEngine on
#
RewriteCond %{DOCUMENT_ROOT}/$1.html -f
RewriteRule ^(.+)\.htm$ http://www.example.com/$1.html [R=301,L]
This routine takes the requested URL-path, removes ".htm", adds ".html", and prepends the document root filepath, essentially converting the requested URL-path to a filepath. It then goes and checks to see if that filepath resolves to a physically-existing .html file. If so it does the redirect, and if not, then it does nothing and the request will get a 404 response.
So legitimate requests where the only error is "htm" versus "html" get fixed-up, while the requests for viagra.htm and asdfgh.htm get a 404.
This only works if the .html files exist as physical "static" files. If you are rewriting .html requests to a script-generation script instead, then that script will need to be modified to do essentially the same thing: Check the database to see if a page can be generated after changing ".htm" to ".html" and if so redirect. Otherwise return a 404 response header and a 404 page.
I dumped the <IfModule> container, since its only practical function would be to allow the rule to fail silently if mod_rewrite is not loaded.
Jim