Also consider the following (they're also available under pfsense as well, if you go that route, but probably available on many other platforms:
As its a home network, I assume guests will use it. Set up 2 subnets that are separated, one for trusted use and one for everything else. Set rules that stop the 'everything else' network speaking other than to the WAN, or at least very limited other LAN locations. Use certificate based authentication not WAP2 on the trusted network (802.1X /WPA2-enterprise), its not hard to set up and it makes the network a lot more secure as you need a certificate (saved on your device) and password not just a password. Or look up OTP (one time password) which are those little tokens that change unpredictably and make 2 factor login possible. Don't trust MAC authentication as it can be spoofed. These will raise the barrier for people trying to get network access without permission.
Probe your own network - pfsense has nmap, use it. Check with online port scanners.
Assume your own laptop/device is a possible weakness (if someone controls that they get the network too). Ensure its secure and use good practices there.
Run squid + a network based malware scanner, and an IDS like securicata or snort. It won't solve everything but will catch a lot of known attempt types.
As for pfsense, one other idea - instead of multiple routers, get a 2008 core2 board (dual core or Q6600 or similar, they're all cheap) with 4gb ram for £50/$75 and a small (8-16gb) ssd off eBay (sometimes called a "disk on module"), put pfsense on it, and stack it with 2-3 network adapter cards off eBay (Intel if able and able to handle vlans for when you need them, most Intel Gb cards will). It'll cost less than an OEM router and it'll handle all the above with plenty of juice to spare, and handle any routing and firewalling you're likely to need between half a dozen local networks (whether physically separated on different poirts or logically separated by vlans). Don't worry about server quality - this kind of board can last many years and is cheap to replace/fix 2nd hand if it goes, and you don't need 99.9999% uptime.
Random ideas. Good luck!