If they are physically removing memory to bypass a firmware password the best you can likely hope for would be to add some sort of physical barrier.
-Some of the "Warranty Void if Removed" type holographic stickers would be ideal.
-It's possible you could physically attach the memory by some means such as some form on NON-conductive sealant/epoxy.
-You could also potentially replace the access screws with some sort of security screws.
This doesn't prevent them from doing it but makes it easy to tell upon inspection it has been tampered with. You could implement a policy that tampering with systems will have some sort of fine/penalty associated with it. In the end, if they have unsupervised physical access to the systems there isn't much you can do to prevent it as it is a fail-safe in case of lost/forgotten password.
As for the wireless issue... in a single user setup there isn't much you can do to prevent it. If you are willing to migrate to a multi-user setup you can check out the KB article at
http://support.apple.com/kb/HT3389. You could mimic a single user setup but still have it be a restricted multi-user setup. Restrict the user that they have access to and you restrict the amount they can do with and to the system. You can restrict the ability to run certain programs, change certain settings, etc.
If they take these systems home and wish to use their home based wifi with the laptop (for school work obviously) you could add the default access point names, specify a certain one they would have to reset their home AP to, or you could provision it on an individual basis.
You may say you don't want to restrict the students/users too much, but the fact is if you want the systems secure you pretty much have to. The best way of doing this is with a multi-user setup with an Administrator account that they are not allowed to access. Yes, it does restrict the functionality and flexibility of having a laptop, but seeing as it is a school laptop it should be restricted to school tasks.
EDIT: I just reread that you said they pay for half of the laptop. That certainly makes it a murky dilemma indeed. However, I stand by the suggestions for mitigating the tampering. The school pays for half. Therefor you (the school) has as much legal right as they do to them. If they are caught tampering with the systems they could be fined. They should have the option of being released from the restrictions under the condition they repay the school's portion of the laptop.
I understand now why you have simply done a single user setup, but it's a trade-off. Do you want control and them to use the laptops for schoolwork, or do you want them to have free reign. You can't have both.
Fact is, in the end, if you lock something down they will try that much harder to unlock it. I did it myself when I was young and I still do it to this day.
