The main question is: What's your threat model?
A hard disk getting lost? An attacker stealing the server (or its disks) from the CPD? A hosting company employee going rogue?
What cost are you willing to pay for an enhanced security?
You would get the most assurance by combining a TPM with a user-provided passphrase.
Yes, even a headless server could be provided a boot passphrase: it can get a keyboard or a KVM connected for the boot process. Or alternatively, a usb stick which is inserted for the booting process and then removed.
The main drawback is that such server cannot reboot automatically (in case of maintenance or a power-cut).
Is there any protection against a boot-partition modification? E.g. a signature?
This could be done with Secure Boot and proper chaining. You would probably need to configure it with your own keys.
Note that having a verified boot partition would not prevent an attacker from extracting the disk and their contents.
You could remotely provide the key to the "verified boot partition", but someone who cloned your disk could impersonate the server (basically, create a MITM which syphons the decryption key). You would need to ensure that you are really talking to your server-with-verified-code and not an evil clone. This is surely possible using Intel SGX or similar technologies, but probably not trivial.
Regarding your Bonus question, you boot the final kernel. The initramfs mainly provides some extra modules and scripts. While a two-kernels procedure would be possible, I'm pretty sure you don't have a separate "system kernel", only the one stored at /boot which is the one you are booting into (plus perhaps some older, unused ones).
Little known fact: although it's not of much use in your case, it is possible to have an encrypted /boot, with grub decrypting /boot (and since /boot is encrypted, it can contain the keys to decrypt the rest of the disk, anyway).