I know this would not be easy (but if it was I would have no-interest to do it!).
But perhaps the best idea is to put a bootloader that allow us to choose between two options:
1°)Boot the Pandora OS
2°)Boot from SD slot
Then we could never touch the pandora OS, and still play with any...