Actually, the maximum number of combinations an Android pass-pattern can have, given that the user must choose a pattern of at least four unique dots and can use up to all nine, is 9!+8!+7!+6!+5!+4! = 362880+40320+5040+720+120+24 = 409104 combinations, about 2^18.6. Child's play for a computer, made marginally more difficult by its being a UI-based entry scheme, and the cooldown period most Android phones have after 3 incorrect tries.
You can "lock" the SD card/SIM with a PIN that only allows it to be used in that phone by someone that has properly unlocked the phone. I'm not sure how easy/hard it is to break that layer; I would hope it's implemented via a decently-secure level of encryption.
In the worst case, Android phones support an option that wipes all data after 3-5 failed unlock attempts; if the data on the phone means more to an attacker than you, do this. Combined with encrypted phone and SD storage, this is about as safe as your phone's data will get. Most phone manufacturers and cell carriers provide offline backups; if your phone were to get wiped, you can simply restore the backup (restoration requires multi-factor authentication by providing a code they either gave you or that you gave them), and most of the things that make your phone yours are back in place. Other companies support remote wiping and/or remote bricking; report the phone as lost and the cell carrier will order the phone to factory reset and wipe the SD card, and/or to brick itself. Of course, the phone has to receive that command; you can work around it as a thief by quickly getting the battery out of the phone or putting it in Airplane mode, and then doing further work with it in a Farraday cage shielded from cell signal (It's really not as farfetched as it sounds, but it only works if the data the thief is after is on the phone itself and not somewhere the phone would give them access to).
