BIOS
The user should set her BIOS to disable booting from removable media, and password protect her BIOS/bootloader. This would prevent an attacker being able to boot from a USB drive or a LiveCD, unless perhaps they disassembled the laptop in order to remove the CMOS battery to either cause the BIOS to reset, or to physically replace the BIOS chip. She should also consider write-protecting the BIOS chip.
HDD/SSD
Full disk encryption would protect against data theft as long as the attacker could not access or determine the encryption key. It would also prevent an attacker changing the root password by booting into single user mode or booting from an removable drive.
Operating system
Qubes OS has some features, like Anti Evil Maid and DMA protection via VT-d/IOMMU that should reduce the attack surface further. An attacker wouldn't be able to perform a DMA attack via Firewire, Expresscard or Thunderbolt interfaces, for example. (Qubes, unfortunately, ships with numerous binary blobs, and may not be compatible with a GNU/Linux user's desire to run fully free software.)
Traditional measures
A laptop could be configured to perform some more traditional alarm or security functions, e.g. sounding an alarm upon motion detection; or streaming video from a 360-degree webcam to a server, so that the footage could be reviewed later and would identify any attackers, effectively providing the laptop with CCTV.
A good lock (not one of these) secured to the laptop's lock slot, and to an immovable object, would make the laptop harder to steal, as would putting it in a locked anti-theft bag (e.g. from PacSafe or one of their competitors) or hard case and locking that to an immovable object.
Tamper-evident seals might help reveal any attempts to open the laptop's case, although tamper-evident seals that will defeat a skilled attacker are apparently hard to find.
Different computer?
Some computers, e.g. the ORWL, are designed with physical security in mind, and come with built-in tamper evidence and protection against thermal attacks such as cold boot. (The ORWL, unfortunately, ships with many binary blobs, and may not be compatible with a GNU/Linux user's desire to run fully free software.)
Education
Finally, the user should probably also inform herself about the range of attacks and possible defences. For example, she might wish to read about security engineering, or to watch Daniel Selifonov's talk from DEF CON 21: A Password is Not Enough: Why Disk Encryption is Broken and How We Might Fix It.