Obsessed with system security, yet you're not using bsd? Strange times.
The most convincing approach I've come across involves encrypting everything except /boot, which is put on a usb stick. If you don't have that usb stick, you're not getting at the data.
Bear in mind that encryption is worth nothing if someone stole your computer while it was turned on.