GRUB and Encrypted Boot
The best security is to have GRUB protected by Secure Boot, and the entire disk encrypted including kernel and initrd image, which would prevent any chances of attacker tampering with the files (the evil maid attack). Since 2.14rc1, GRUB supports the Argon2i and Argon2id PBKDFs which are considered secure; See upstream commit. (Discussion).