Locking SYS and SYSTEM Accounts
Lock them both (SYS and SYSTEM). You shouldn't need to use them day-to-day, nothing will break.

On a day to day basis you should be using named user accounts that have SYSDBA or SYSOPER.

Tom Kyte recommends doing it, so you can always blame him if something does go wrong :-)