Actually, in the long run it is impossible to make it that someone with physical access to the device cannot run arbitrary code on it.

See the first of the 10 Immutable Laws of Security: http://technet.microsoft.com/en-us/library/cc722487.aspx