@Tetsujin answer is almost correct. Unfortunately just encrypting the drive will not prevent certain ways of circumventing your system by planting trojans (as you claim to be paranoid)
The correct solution is to "encrypt your drive with a system that uses TPM" - Bitlocker, BTW, does this (but LUKS, and, to the best of my knowledge Truecrypt/Veracrypt don't by default). TPM ensures the integrity of the entire boot process and derives the unlock key from modifiable registers - meaning your data can't practically be accessed unless the master passphrase (kept away from the computer etc) or the regular password is known. Logging in to the BIOS and changing anything will invalidate the regular password.
Unfortunately making your computer unusable if its stolen is not possible - its pretty much always possible to reset to factory defaults - even if this means removing the BIOS/UEFI support battery.