Just encrypt the whole hard drive with cryptsetup-luks and turn off the laptop when you leave it unattended.
An attacker can still corrupt the hard drive or steal the machine, but almost surely won't achieve anything beyond forcing you to buy a new machine and restore backups.