Yes, you can protect your themes quite easily(except for the images)
By restricting access to the "thtml" files you'll protect most of the goods particularly the php variables and snippets of code. Somebody might be able to reconstruct your thtml page manually(which is extremely tedious)but if they're good enough to do that then they're good enough to make their own theme and wouldn't want to bother.
To do this, put this in your .htaccess file
Text Formatted Code
<FilesMatch ".thtml$">
deny from all
</FilesMatch>
Despite what you might think, this does not break the site because apache does not have to serve the file. It's the php script that needs to access the file to be read in and then parsed. Access for a php script to read a file is determined by file permissions not .htaccess
And if you want to be a little trickier, create a .htaccess file in your layout directory like this:
Text Formatted Code
ErrorDocument 403 /404.php
<FilesMatch ".thtml$">
deny from all
</FilesMatch>
Error 403 is the "access denied" error. By changing it to whatever your 404 error page is you make them think the thtml pages somehow don't exist. Somebody may also know a way to get apache to report http status code of 404 as well.