In your LILO configuration section, write something like:
image = /vmlinuz label = Linux root = /dev/hda1 password = wingedlizard restricted read-only
Then chmod this file 600 (so nobody but root can read it) and re-run /sbin/lilo.
The “restricted” keyword means that LILO will stop and ask for a password if you try to boot this kernel with _any_ keywords such as “1” or “single” or “init=/bin/bash”. A password won’t be required during normal (no-added-keywords) boots.