Ridiculously simple idea:
Bootloader shows a colorful background which is derived from the hash of the kernel you're booting. If you get evil-maided, they would have to install a new custom firmware which fakes the same colors, and there are a number of ways to make this really difficult to reproduce...