Here's what I do (on a Mac)
I created a symbolic link to point to an encrypted volume which contains my wallet.dat. Unless I've mounted that encrypted volume (which is just a megabyte), I can't send bitcoins. I use Knox to manage the security of this volume, with AES 256bit encryption (
http://agilebits.com/knox). I keep this volume safe (offsite and onsite).
You can also use this method using TrueCrypt, which is free but not as easy to use.