What exactly are you imagining the maid doing, taking apart the laptop, removing the hard disk, mounting the EFI partition on another device... at that point, why not just install a physical keylogger?
To me, this sort of threat model never made sense, once physical access is possible your main worry ought to be https://xkcd.com/538/
Some people might say they have a detached bootloader (secondary USB which contains the LUKS headers+bootloader), but that depends on them actually keeping the two separate. Even then there is no way to authenticate what you are booting.
Let me introduce you to TPM, signed binaries and measured boot!
However, the most secure ways usually involve a flashed kernel (coreboot) on a write protected NAND chip, of course with encrypted root, that start the boot process by dumping and sha'ing the NAND and comparing that to the whitelist.
On my laptop the SSD can be removed and replaced in 1-2 minutes - you just remove a single panel with 2 screws to get at it. On the other hand, the keyboard would take 10+ minutes to get at and rebuild the computer.
> To me, this sort of threat model never made sense, once physical access is possible your main worry ought to be https://xkcd.com/538/
Sometimes, compromise without the target's knowledge is useful.