I wonder if standard Linux boot-loader should in some way check the BIOS FLASH content, like displaying/saving the last CRC32 of that FLASH.
It is very difficult to lie (i.e. intercept requests) to a boot-loader running in real mode, using only physical addresses, and it is easy to detect that you are in fact in virtual mode instead or real mode.
The problem is that this CRC32 may change when the user changes BIOS options, probably some of them are not stored in the RTC battery backed RAM anymore because of size problems.
Also determining the size and location of the FLASH for whatever PC may be difficult.