Unless you have a TPM or something you just don't; this is an unsolvable problem in general.

For all of my use cases, either physical access counts as game over and is out of the threat model, or we're using Secure Boot for verifying the bootloader and/or TPMs for keeping secrets, at which point this is a problem with known solutions that aren't specific to image-based updates. If you're using Secure Boot with read-only images, one thing to try is dm_verity, which is how Chrome OS solves this problem - it's a Merkle hash of the entire block device that's checked lazily as blocks are accessed. If a block has been tampered with, you can configure dm_verity to either panic the system or return an I/O error for that block. (Or you can just read the entire image and verify it up front at the cost of slower boot time.)

In particular, for all my use cases, there's already some mechanism for the device gaining a secure channel to the rest of the infrastructure, so if you're worried about keeping updates secret (which you may or may not be!), just protect updates by that mechanism.