How to password protect all grub entries except current running kernel?

Question

What would be the best way to password protect all of Grub's menu entries, except for the current kernel?

Also, I would like it if it the password-protection would survive upgrades, always automatically protecting the current kernel.

I would prefer to do this without having to edit a ton of Grub files individually, if possible.

Thank you!