I am looking for a way how to improve security of this scenario. Offcourse with psysical acces you can do pretty much everthing but removing usbdrive, alterning its content and consequently rebooting router is way to easy. Maybe some script to check hashes of files before mounting with exec could fix this problem. I am looking forward for your opinions and (better) ideas. I would be glad if someone could post some already tested and tuned solution. Thx. in advance.

Integrit is lightweight file verification system that works well under OpenWrt. 

I built a package for Whiterussian a while ago, but haven't updated it for Kamikaze.  Basic setup instructions can be found here-

http://packetprotector.org/documentation/IntegritHowTo

Hope this helps,
Charlie