Given the "only one computer" restriction, the best way is to have your "insecure" OS purely on a write only medium like a 100% full CD, DVD, or Blu-Ray. This, however, can be very cumbersome and annoying (though it is very cheap).
Disconnect the hard drive completely before booting off the optical media.
The next best way is to have 100% separate hard drives - something like a hot swap capable bay or dock makes this very easy to deal with.
Encrypt both of them with different keys (which should automatically happen with Checkpoint or Linux's built-in LUKS or Truecrypt on Windows), and ideally with separate passphrases.
Note that most encryption, particularly most system boot encryption, does NOT encrypt the boot record/MBR/boot partition - it must have an unencrypted area to bootstrap the encryption from, and this is a place malware can host itself in, too (plus the Evil Maid). You could destroy that data from read-only media every time, and then boot with a recovery disk each time; that's also very cumbersome.
Use only one at a time. Never ever have both connected at the same time. Shut the system down, cold, before switching them - for half an hour or more at a time if you're truly worried (or do a RAM test off of a boot CD in between)
You are still vulnerable to a variety of threats; if at all possible, remove all networking physically when you're doing this unidentified work you're worried about doing on the insecure box - otherwise you're still vulnerable to network based threats.
If you want another layer, in both of them, use a virtual machine to do work that's actually sensitive - encrypt that OS separately if you like, and only decrypt it when you're going to use it.
BIOS based threats are still going to be shared, of course, as well as any hardware based threats (hardware keyloggers and the like at the low end).