There is unfortunately relatively little you can do to thwart such an attack, apart from keeping your notebook with you at all/most times.
Though using a USB key for /boot might be an idea, it is a little less clunky than a ThinkPad and since I suspend to RAM most of the time, it could even be practical. Hm.
