Thanks all for the replies, I'm going with setting a BIOS pw and locking the case. Even though it's not perfect, it should be a suitable impediment.
a way to lock him out from partitioning the drive, is to set the boot order to harddrive first, that way there is no possible way he can partition the drive from a cd. and you cant partition the drive when you're running windows off of it.
the whole idea that neodude had about hiding the router is an excellent idea IMO.