Step 1 is going to be figure out what you are prepared to trust and work upwards from there.

There will always be an infinitely recursive list of trust issues or potential attack vectors, they will just become less and less likely.

What if the hardware wallet is backdoored? Use a Faraday cage. What if both the hardware wallet and Faraday cage is compromised? etc.