[oxplot]

You can check for a magic string after decryption and only update the screen if valid.

[nybble41]

At this point you might as well just require a plaintext password to update the screen, and forget the XOR.