[avaloneon]

You might be interested in something like ORWL[1], which is arguably the most secure consumer PC I've ever heard of. It has tamper-resistant features, full disk encryption, and a secure co-processor which does things like disable the USB data paths when the system locks.

Admittedly, though, it's not a laptop.

As far as laptops go, the librem 13[2], with Qubes OS and coreboot would be a pretty good bet.

If you haven't already, definitely take a look at Qubes OS[3]. It offers security by compartmentalizing different workspaces in different vm's managed by Xen so, in theory, even a kernel exploit isn't getting very far into the system.

[1] https://www.crowdsupply.com/design-shift/orwl [2] https://puri.sm/librem-13/ [3] https://www.qubes-os.org