fsprotect is available as a debian package. It is only available from testing and unstable. It also depends on aufs, so you'll need that too.

To install fsprotect do:

# apt-get update
# apt-get install fsprotect

After that:

• Edit /boot/grub/menu.lst or /etc/default/grub2 or /etc/lilo.conf and add "fsprotect=1G" to kernel parameters. Modify 1G as needed. Apply changes (i.e. run update-grub)
• Edit /etc/default/fsprotect if you want to protect filesystems other than /.
• reboot

You may also want to password protect the grub bootloader or forbid any changes to it.