Another approach to this particular issue is to use the TPM to store an encryption key, but the defense does rely on the user to make it effective. A rudimentary, RHEL7-based solution is tpm-luks (https://github.com/GeisingerBTI/tpm-luks).
The way it works is on boot, each step of the boot process measures the next and stores this measurement into the PCRs on the TPM. Once the boot process is complete, tpm-luks checks the status of the PCRs against a "known good" configuration. If in a "known good" configuration, the TPM will unseal the LUKS key, and tpm-luks will pass this data to unlock the root LUKS partition.
Because everything important is measured with a crpytographic hash, there's essentially no way for an evil maid to replace your GRUB/kernel/ramdisk to nefariously collect your FDE passphrase. As an added bonus, you don't need an FDE passphrase at all! You could in theory completely remove the human-readable passphrase and rely entirely on the tpm-luks, but if you go that route, it's probably a good idea to store your LUKS header and keep it as a backup.
As I mentioned, this requires some diligence on the user. If you've left the computer unattended, and you are presented with a passphrase prompt, it's probably a Bad Idea to type it in until you've done some investigations. At that point, you should boot into a live CD environment and take a look to see if there's a bug in tpm-luks, or if the
/boot partition was truly altered. You still are leaving the
/boot partition unencrypted, but if anything important gets altered, the main disk is never decrypted.