You can password protect the bios and the grub menu items.

setting the bios to not boot from anything but the first HDD and
password protecting bios and password protect the bootloader, the
rescue mode and old boot items using strong passwords will cover
everything but the removal of the HDD from the machine.

I think it has been noted that physical access trumps most efforts at
being totally secure.