The Ubuntu VM's virtual hard disk is right there for the taking, though.
>Ring....
>Ring...
[pickup]
>"Adversary profile precludes this vector"
[/hangup]
I've now got one for "press one if you're calling me about an unbelievable sales opportunity" that gives the exact response. I have no idea if anybody has called it yet, but it's kept me laughing for the past three days!
OP could get at least get screensaver-lock functionality, but actual security in this situation is hard.
Using a VM as the "real" machine seems to be at least as effective as any other suggestion made here and far less brittle.