how to add a custom lock for the recovery and/or bootloader?
Encrypt your filesystem. You'll need to enter a password or PIN on every boot to decrypt it, so as soon as the device is rebooted none of your personal data will be readable. TWRP even supports encrypted filesystems (it prompts you for your password when it starts as well, I think). If your device is at least 4.2.2 then you can even leave ADB on; they'd need to unlock the screen to add their computer to the whitelist, so they can't push apps or read data there either. You'll be able to have root, a custom bootloader, ADB enabled, and still have a relatively secure device.