It is impossible to completely prevent such attacks, at least without any major system reengineering and a heavy burden on the user.
If an attacker has write access to your account, then the user can create a mock environment that hides all traces of the compromise to your eyes. The most obvious way is to use
LD_PRELOAD to load a library that hides itself and whatever else the attacker has planted (this wouldn't work on statically linked binary, a more sophisticated wrapper is needed there).
The attack would remain visible to other users until the attacker has escalated to other accounts. So you could make a process running as root check the files on your account and report any change. The problem with this is that you'll be making a lot of legitimate changes; it's unlikely that you'd be able to notice an illegitimate change amongst the noise.
There is a way to contain the damage to your account, which is to require any privilege escalation to go through a fully trusted user interface. This would mean that:
Both approaches only work for local logins. You can't be sure of the path between you and the system when working remotely. And you can't use anything convenient like
sudo, copy-pasting the command and so on; you fundamentally need to do something disruptive from a UI point of view, like switch to a different terminal.
Oh, and once the attacker is root, he can easily install a rootkit that makes it impossible to detect. Local attacks are common anyhow; if the attacker has compromised your account and this is an advanced attack (not necessarily the case if you merely left your terminal unattended), assume that the root account is compromised too.