Firmware would not necessarily be modified in an attack like this, and this method would detect any persistent changes you make that are written back to NVRAM.

Definitely wise to prevent remote login from outside your LAN though. Also you can always run an IDS like Snort on your router; a proper IDS is probably the cleanest solution to this problem.