It's possible to scan lightning components for LockerService errors using Heroku and Salesforce-Lightning-CLI plugin.
Am I correct in assuming that there is no way to scan managed components for compatibility with LockerService?
Managed package components have their IP protected and hence you cannot peak into the code ,so the CLI cannot scan those files .If a managed package component is not locker complaint you can see that once you activate locker for an org ,it will stop working .You will have to reach to vendor in that case to have it fixed .