It can't be turtles all the way down. If you encrypt /, then you're still not encrypting the kernel and I win. If you encrypt the kernel, then you're still not encrypting GRUB and I win.

There's no way to prevent anyone from tampering with your system, or even to make any tampering evident. The best you can do is a cost-benefit analysis and risk analysis of the different options.