Simpler version is to encrypt root partition and have kernel with boot loader on separate sd card or usb flash drive.
Or someone could come in an pop in a drive with their own kernel.
Nevermind the reality that I'd never completely follow through with the security measures needed on a personal machine. I'd just be giving myself an active role in my home's security theater.
I just encrypt my home folder and don't trust machines/networks for important things.
Still somewhat vulnerable to a replaced BIOS and/or a hardware key logger (I gather the idea is: I can keep my usb key safe easier than my laptop. I'm not sure if that's true in a meaningful way).