Is there any way to (partially) defeat keylogger attacks against system-level password entry on OS X?
Yes. The traditional keylogger is a hardware device that intercepts data between the the keyboard and the intake of character data at the Keyboard Controller (mostly USB Device, HID Keyboard). The physical components are few and various tamper evident seals may be used to assure the integrity of the physical system. You would need a initial check to insure that no physical keylogger exists then attach or install the seals. Frequent or periodic checks of the seals must then be performed to verify that the hardware's integrity is intact.
However most modern keyloggers are software or firmware based and thus may only be defended against by software security methods. This includes the chain from the keyboard controller IC firmware, keyboard controller device driver, OS level USB subsystem, keyboard buffer, and shell software.
This would require you to find the firmware or software for each component in the chain and verify that it has not been tampered with. This is usually done by obtaining from the manufacturer a cryptographic hash of the firmware or software for the component and computing the cryptographic hash of the software currently in use on the system in question. If the cryptographic hash values match then the firmware or software is unmodified.
The more software in the chain, the harder it is to protect and verify just by the nature of growing complexity and more permutations of instruction sequences.
There's several places in my ‘personal security infrastructure’ (is there a better phrase for that?) where I find myself typing very important passwords into text-fields on OS X (for instance, dis-encrypting and mounting thumbdrives containing very sensitive data.)
I'm (perhaps unreasonably) afraid of keyloggers
In hardware keyloggers yes, in software keyloggers no.
as these [Keyloggers] are the only method I can think of short of a system-level vulnerability or physically watching (or recording) my activities when entering the password.
No, there are many other ways of determining your password. The most common one is to find a exposed password or phrase from another system and attempt to use it on the system in question. This is usually successful as most people reuse passwords.
Another trivial example is to attempt to find frequently used keys on your keyboard either from dirt or ware and try the limitied combinations of those frequently used keys to find the password;
Additionally there are various forms of social engineering and phishing that are quite effective.
In other secure systems I use, there's an option to enter a final part of the password using the mouse or similar, to help avoid keyloggers making an attacker's job too difficult.
There are two posibilites here. They keys is split, meaning that part of the key is stored in a container on the system and part of the key is stored in you mind. Or the full key is stored in a container and the system only needs a few charactors to determine which key you need.
There are also two general types of key splits: one I call sectioned, and one I call full key length split. The sectioned one takes a key with n bits and divides it into two or more parts.
For example: take a key 0xA55AC33C and split it to 0xA55A and 0xC33C.
The full key length split takes a key of n bits and divides it into two or more parts of length n.
For example: take a key 0xA55AC33C and split it into 0x42244224 and 0xE77E8118.
The sectioned split is a poor choice for several reasons including exposure to brute force attacks, and problems recombining the key in the correct endianess and order.
A sectioned split might seem to foil a keylogger, but not if entering the same split allows an attacker to access the sensitive data. For example: if you only need to enter 0xC33C and the keylogger records this then an attacker can enter 0xC33C and gain the same access.
Generally, shell level commands which do not output sensitive charactor data to the screen or to the shell log buffer are more secure than graphical components.
