It was difficult to make a title because of char limit.
when you use me_cleaner to neutralize intel ME, it also removes TPM. TPM is required for boot verification technologies like Heads or AEM. So you can't use Heads/AEM and me_cleaner, you have to choose one and in this case we choose to prioritize me_cleaner.
Heads: https://osresearch.net/
me_cleaner: https://github.com/corna/me_cleaner
Then the question becomes, what do you personally do to protect your computers boot firmware? There are many ways you can do that such as the popular glitter nailpolish technique. The problem with that technique is you need a good camera with a firm stand so you can take the before and after pictures at the exact same distance and place to compare them. It's also quite a lot of work to do that every single time you leave your computer which could be several times every day. AEM is also most popular to use when traveling and when traveling, having all that extra equipment with you is a problem.
What else? Maybe a secret camera without any internet connection capability which you can place somewhere in the room with the computer and that way you can know if someone was inside the room and if they did anything with the computer. The camera would have to record to a local storage like a micro sd card and you overwrite all data on that card every day so you won't need too much storage capacity. And maybe the camera only activates on movement triggered then its even easier to quickly check if there's any video when you come back to your computer. You would also need to be sure that the adversary doesnt replace the camera so you dont know its not your camera anymore or if they can erase the video files before they leave like hackers who erase logs. What do you think about that?
Another idea is a container for the computer. The container can of course be destroyed easily but then you will at least know they did something with the computer. But you would need a container that the evil maid can't go get a duplicate of or have one manufactured so they can replace the container after destroying original one.
Same problem with a sticker on the screws to open up the laptop, they could get a duplicate sticker to replace yours. I also heard there are ways to remove a sticker and then put it back again.
Practically I think camera technique is best to use on daily basis because its effective and relatively simple but maybe in some situations you have to gamble by using a container or sticker.
And then you also need to check your firmware once in a while even if you don't suspect anything. I'm not sure the best way to do that because I've read it is practically impossible to know if rom has been maliciously modified. So its probably not enough to simply dump the rom and do a diff against the rom you flashed. Maybe you just have to redo the flash again not knowing if it was necessary or not.
I have a multi-stage strategy.
First and most important, physical security. My computer is valuable enough that if I left it unattended in public, someone would probably nick it and put it on ebay. So I only leave it unattended in places with good enough physical security.
Secondly, I avoid doing anything that would impose spy-thriller-movie-level security requirements on my equipment. My employer wants to secure a critical code signing key? I'll be happy to sort them out with their own HSM in their own properly secured data centre, or their own USB stick in a bank vault, or whatever their requirements dictate. My personal security research? I anonymously publish anything interesting I find right away. And I strictly avoid going to countries where I think the government ought to be overthrown.
Therefore, the chances of an attack targeting my boot firmware are exceptionally small.
Finally, I embrace the reality that the TPM wouldn't have helped me anyway. Firstly the security the TPM offers depends on the security of the BIOS, and we all know that's a joke. Secondly, even if the TPM worked perfectly and the BIOS was secure and so on, an attacker in a position to mess with my firmware could just as easily install a physical keylogger, or a hidden camera pointing at my keyboard, or just have masked goons hit me with a $5 wrench until I tell them the password.