As already mentioned in a previous answer and the comments, you are right regarding that ElGamal is not secure against chosen-ciphertext attacks. An immediate reason is that the scheme is multiplicatively homomorphic, and that is not compatible with CCA: the attacker could query the decryption oracle with the ciphertext that results of multiplying the challenge ciphertext and the encryption of some random message; the homomorphism ensures that $Enc(pk, m_b) \cdot Enc(pk, m') = Enc(pk, m_b \cdot m')$, and therefore, the decryption oracle cannot refuse to respond to the query since the input is different to the challenge; now the adversary only has to remove $m'$ to recover the challenge message.
Also, something worth mentioning is that the proof given in that book does not follow the traditional conventions for proofs in provable security. First, they are not defining the security goal explicitly (i.e., are they trying to prove one-wayness? indistinguishability? some other notion?). And second, usually proofs are constructed as a reduction to a hard problem; that is, these proofs aim to reach a contradiction by which, if the scheme is insecure, then you could solve the hard problem. These proofs follow this template:
- Define a security goal (e.g., Indistinguishability (IND)) and an attack model (in this case, chosen ciphertext attacks). Together they form a security notion (e.g., IND-CCA).
- Assume the existence of an adversary $\mathcal A$ that breaks the scheme under the security notion.
- Simulate the environment of $\mathcal A$. That is, you explicitly construct the oracles required by the attack model. Usually, you need to somehow embed elements from the hard problem instance you want to solve (e.g., elements from a DH tuple $(g^a, g^b)$).
- Prove that using $\mathcal A$ you could solve the hard problem.
- Since the hard problem is assumed to be hard, we have reached a contradiction, so the initial assumption (i.e., the statement in step 2) is false, and the scheme is actually secure.
However, the proof given in the book is doing something different. It is first assuming that there exists a decryption oracle, and then proving that you could solve the DH problem using it. Since the DH is hard, then the initial assumption must be false. In this case, the initial assumption is that there exists a decryption oracle, but this does not prove at all that the scheme is secure under chosen-ciphertext attacks.