How weird: I have found wlogout which can either lock the screen or suspend the laptop, but apparently not both at the same time – at least not by default. I guess what would be even better is to have cryptsetup-suspend installed as well so that when I suspend the laptop, it automatically locks and forgets the disk encryption password. It seems that cryptsetup-suspend would work without any input of mine, so I guess I could install that and just suspend. You'd have to know the disk password (but not my account password) to get back in? I'll give it a try but I'm still missing something.