You can make things a bit harder by locking the boot order in bios and password protecting the bios settings.

Not sure how much this helps against a determined attacker, but it's easy and inconvenience is minimal in most cases.