How can I ensure I retain access to a Drupal site after handing it over to a client?
Yes, as the developer you can control this:


Make sure only you know the (strong) password to the admin (user 1) account.
Make sure Drupal core and modules are up-to-date to mitigate possibility of a security hole that may expose the user 1 login.
Make sure only you have access to the files/database for the site; that way your client can't change data manually that might give them access, or run PHP scripts to do the same.
If you have the PHP filter module enabled, disable it, or at the very least make sure your client can't use it.
Install User One to stop users with the "Administer Users" permission from editing user 1's password.
Make sure no other user has permission to "Administer Permissions" and "Administer Modules" so they can't grant permissions to them selves, disable User One or other critical modules.


There may be some more steps you can/should take, depending on the nature of your relationship/hosting/etc, but those should cover the basics from a Drupal perspective.

I'd strongly recommend being up-front with your client about this. Call it a 'policy' that you have, to ensure a smooth relationship, and position it that your having access to the site for maintenance/updates is actually the right move for them, not just you.