The only secure way to lock these is through validation rules in Salesforce.
You could also create some smart campaign in Marketo that undo any unwanted change, but that will be less efficient, although easier to implement.
for Webinars, which is a similar case, I use the Program Status to keep track of who was invited, who registered, who attended etc. The big advantage of Program Statuses (defined by the Tags in the Admin section) is that People can only move forward through statuses and not backwards. Once the Program Status is set correctly based on the lead's activity, you can use a Smart Campaign that triggers when the Program Status has actually changed, and set the SFDC campaign status accordingly to the Program Status reached at that moment. Maybe that might be a solution for you too?