From what I can gather from a quick glance at the data sheet and your code the filter works on the first two data bytes of a standard frame, not the message ID. I think you're trying to filter on the message ID, but you're using a standard frame, so this won't work.
If you use an extended frame then the mask applies to the full 29 bit ID field.
The mask you have requires an exact match between the message ID and the filter - i.e. only one specific message ID will be received. I think your test code is correct, (i.e. you're right and the message should be rejected), but again, it comes down to using a standard ID instead of an extended ID.
See figure 4-4 on page 32 of the MCP2515 datasheet.