putting the kernel and initrd on a CD/floppy/thumb drive should do the trick as I can carry it with me to reduce the chance of altered looback driver.

For those who want even more security, have the kernel and initrd encrypted with a secondary password and decrypt them before using so even if somone replace the CD while I am sleeping, I would notice that at the first gate entrance without handing out the main password

BTW, the CD-ROM won't be tied up as the kernel and initrd are into memory and the device would be freed.