Modern power grid is fast emerging as a complex cyber-physical power system (CPPS) integrating physical current-carrying components and processes with cyber-embedded computing, which faces increasing cyberspace security threats and risks. In this paper, the state (i.e., voltage) offsets resulting from false data injection (FDI) attacks and the bus safety characterization are applied to quantify the attack consequences. The state offsets are obtained by the state estimation method, and the bus safety characterization considers the power network topology as well as the vulnerability and connection relationship of buses. Considering the indeterminacy of attacker's resource consumption and reward, a zero-sum game-theoretical model from the defender's perspective with incomplete information is explored for the optimal allocation of limited defensive resources. The attacker aims to falsify measurements without triggering threshold alarms to break through the protection, leading to load shedding, over-voltage or under-voltage. The defender attempts to ensure the estimation results to be as close to the actual states as possible, and guarantee the system's safety and efficient defensive resource utilization. The proposed solution is extensively evaluated through simulations using the IEEE 33-bus test network and real-time digital simulator (RTDS) based testbed experiments of the IEEE 14-bus network. The results demonstrate the effectiveness of the proposed game-theoretical approach for optimal defensive resource allocation in CPPS when limited resources are available when under FDI attacks.