Another "defense in depth" step would be to move your router off of 192.168.1.1. I recall seeing some browse-to-evil-webpage based attacks a while ago, and if the evil webpage can't guess your router IP (and it's not like it has access to your TCP settings in general) that can't work.

Obviously, just like moving SSH off of 22, this isn't a real defense, but it'll make it that much harder.