With EFI it should be possible to boot directly into the kernel code, you just need two things to happen. Enable EFI hooks when building the kernel (assuming that work has finished for 3.1) and have some way of writing boot options into the kernel binary.
However if an attacker has physical access to the machine necessary to modify the firmware, then you're screwed no matter what you do. (RAMdump or keylogger)
Re: I've just upgraded and there's a problem
However if an attacker has physical access to the machine necessary to modify the firmware, then you're screwed no matter what you do. (RAMdump or keylogger)