As has been mentioned the bottom line is anything you can put in, the baddie can rip right out, so all that you can really do is make the amount of work necessary to do this an obstacle to anyone even trying. What has been suggested so far would at least deter the casual thief and maybe that's enough.
The way I found around it was to actually have quite a tight integration with server-side data, such that even if you removed all of that integration (which would most likely take you days ... it's a big app) you would still have no data at all with which to use it. This obviously depends quite a lot on what your app is doing in the first place, but if you make an architectural decision to move any data over to the server side that will increase your protection.
(This should really be a comment rather than an answer, but posting here due to length.)