To generate a password:
$ grub-mkpasswd-pbkdf2
Now use the diff as a guideline to modify /etc/grub.d/.
NB: I've only modified the files I needed to; depending on your configuration you may need to modify additional menuentry and submenu entries in other files.
To make the changes take effect:
$ update-grub