Your first step is to ensure that the system reliably locks when not in use (sleep mode or session lock).
The laptop may be powered on, but at that point the only ways to access the data are network vulnerabilities, very advanced Van Eck phreaking, and hardware exploits (bad USB, HDMI, Thunderbolt, SDXC); all outside of the average thief's or snooper's province. If you're not okay with this, then your evil maid has probably a Shabak badge somewhere in her room, and I'd start researching stand-alone self-destruct deadman devices.
To clarify: when I say, 'hardware exploits', I refer to the knowledge and back-end technology required to deploy and use the necessary hardware devices, not the considerably more difficult task of developing and building said devices. To successfully exploit your Linux PC through a malicious USB MIDI device or similar, your evil maid must not simply be able to purchase a BadMIDI dongle on the dark web, they must know what they're doing and have already gathered intelligence on the target system -- otherwise, the overwhelming majority of hardware exploits will result in a plugged-in thingamajig that does nothing at all, or freezes/damages the laptop not too differently from a way cheaper spilled glass of Coke, or maybe fills the dongle with a capture file full of useless kernel cruft.
We should also assume that the login environment is reasonably secure. A possible way in (I've seen it done) could be high-resolution, high frame rate scan of someone typing their password. There are battery-powered, movement-activated stealth cameras that could do just that, from the chandelier above.
I would also consider a sequestered system somewhere, and accessing it remotely through a VPN. Then the laptop will actually contain nothing of import. That may be awkward and inconvenient, depending on your average work day (there are some places with really poor connectivity, or intermittent connectivity, such as commuter trains), but if you work a lot with your browser then I'd assume your network layer is usually pretty solid.
However, once you trust the powered-on system lock, your next step is how to have it engage automatically. This can be done in several ways, from NFC receivers that recognize your ring (or chain, bracelet, even implanted device - but those are unreliable) to BLE devices - or physical tokens such as Yubikeys and more.
In this case, you would get up and go get a coffee, and the maid would come out from behind the curtains to find the laptop locked, its data unaccessible. Rebooting would fall afoul of the full disk encryption. Crashing out of the X server can also be thwarted (and usually is) by having it fall down to a system prompt, that also requires a login. Stealing the whole laptop won't change things.
At this point you're still vulnerable to, I don't know, memory freeze to recover the crypto keys, but... again, if your attack surface involves people that fiddle with trichloroethane or liquid nitrogen Dewar bottles and the associated memory-raping equipment, you're way more likely to be defeated by rubberhose cryptanalysis.
idle unmount
There are several ways, depending on your window manager, to run a script after some inactivity (or at screen lock).
Let that script run veracrypt --text --dismount, and Bob's your uncle... in theory.
Before that, actually, in practice you should also use fuser or similar methods to determine whether or not there are files open on that volume. And if there are, then you may need to save and close them. For several applications (e.g. LibreOffice) you might make it do with,
xdotool search --name ${WindowTitle} key ctrl+s
sleep 2
xdotool search --name ${WindowTitle} key ctrl+q
(You still need to calculate WindowTitle from your document's name and LO localization).
After that, kill any applications with open files just to be sure, and run the unmount.
