I see no obvious flaw in your reasoning. However, this scenario requires you to always have your notebook near power supply. An attack as you stated might be carried out anyways with you thinking it powered down because the battery was low.
Considering the hard disk is down, an attacker could modify the "Please enter password" part in your boot-loader to log passwords. This would, of course, never trigger if you always kept your notebook switched on.
Also, leaving your machine unattended and not suspended might pose other security risks as well. A common scenario would be Firewire which as DMA (direct memory access). Other possibilities would be faulty handlers of other external devices like USB (autostart etc.).
I'm curious if anyone has some suggestions on lower-level attack techniques that might require more knowledge in electrical engineering than I can spare right now ;) Could one disassemble and tap something with the RAM still powered on maybe?