How to be sure the boot is secured

LIDS have an option to raise security alerts when unprotected programs are executed before LIDS is sealed. Select this option. You can unselect the option that try not to flood logs, to be sure not to miss any unprotected program. Then you can boot and see in the syslog which programs you still have to protect.

Note that this won't give you the modules you load and you haven't protected.