The concern of yours should not only be from "recovery mode" but also those when Windows is not in use. Most attacks modify the SAM file, which is not writable when the Local Security Manager process is running. This file contains the credentials for the local machine to permit logins. The classic case of bypassing this is when you boot to a Live CD and use tools to modify the SAM file, either to change the passwords or blank them.
The only thing that can prevent unauthorized changes is using the syskey utility built into Windows (XP/7). This acts as a "universal logon password", as a user must provide a password for Windows to decrypt the SAM file before it starts using it.
How secure syskey is, or if blanking can still be done, I honestly can't comment. The guaranteed way to prevent outside tampering is employing whole disk encryption. Select versions of Windows include BitLocker, which can serve this purpose.
Other solutions include TrueCrypt, but again employ whole disk encryption.
If you really wish to test the waters, you can use the built in file system level encryption in Windows. EFS (Encrypting File System) is tied to your password and other credentials, such that if something was to change, the certificates for encryption are "unrecoverable". This again is only available in select versions of Windows.