What I thought of is an actual bitcoin wallet device. It would run a minimalistic version of the bitcoin client in firmware (naturally encrypted and password protected). All inputs would be via touch screen via the use of one of those secure keyboard apps. This device could be connected to the internet but only via a physical connection. And further it could only connect to the bitcoin network and have no other tcp/ip capabilities. The device should also be physically hardened. Also a "wallet backup" feature should be available and a simple usb port should be there as well.
Or just buy a used Android phone off of Ebay, and install your custom client with the cell radios turned off. whenever you needed to update the blockchain or otherwise access the p2p network, then turn on the wifi radio and connect temporarily. The truly paranoid could open up the phone and de-solder the radios other than the wifi. Or the
really paranoid could de-solder them all and only use a usb cable to connect to the p2p network.