1) Enable disk encryption (System Preferences -> Security and Privacy -> FileVault)
2) Regular backups with TimeMachine to a USB drive. It your machine is lost you can use this to restore everything back to how it was pretty quickly. By default TimeMachine backups aren't encrypted, so make sure you check the "Encrypt backups" option when enabling it.
3) As well as using "Find my iPhone" (which requires the device to be connected to a network), I have a message with my contact details on the Lock and Login screens (System Preferences -> Security and Privacy -> General -> Show a message when the screen is locked).
4) Even if the disk is encrypted it can still be wiped, reinstalled and sold on to unsuspecting buyers. You can set a firmware password which will prevent that: https://support.apple.com/en-us/HT204455
(I had a Mac stolen a couple of years ago and as soon as I got a new device and got home I was back up and running as if nothing had happened. A few months later I even recovered the device - the police carried out a raid and found a number of devices, and contacted Apple for the owners based upon the serial numbers)
Something I've never tested -- how does TimeMachine handle things like a locally installed Apache instance somewhere on the primary disk? If I lose my laptop and do a restore to a new machine does it set things back as-if nothing had changed?
You can have TimeMachine either recover the user data, programs, or the whole system. It's not a full system image, but so far it's been working fine. Migrated across 4 or 5 machines using TM.
Time Machine backup in Mac OS X is arguably the most rock solid consumer-friendly backup and restore solution. It's one of the big reasons I stick with Mac.
FileVault full disk encryption is also pretty solid. I won't speak to its efficacy against the most notorious adversaries (e.g. Governments) but it will reliably thwart any adversary most people would ever actually care about.
Apple's firmware passwords seem to work well, though I have no idea how robust they are. It's just a damn shame it's nowhere as easy to set up as the iPhone equivalent. (Just turn on Find My iPhone and that hardware is activation-locked to your iCloud account.)
What is the OP's setup (and what are some alternatives), that he is so sure this was the case?