Wouldn't it be simplest to refuse more than 4 attempts per minute? I suppose it would sometimes frustrate the owner bungling the code, but stretching out brute-forcing the whole space to hours instead of minutes would make it a lot less appealing to would-be thieves...