I guess the quick answer is, there must always be two crew members in the cockpit at all times. So before a pilot leaves the cockpit for any reason a crew member comes in and stands behind the door to let him back in.
Trust no one, the cockpit must always have two people in it, I think is a must be solution, no matter what is done with the door system.
A cabin crew member in the cockpit might help in the case of a suddenly incapacitated pilot, it also opens the possibility that a "sleeper cell" terrorist working as one of the cabin crew could attack the remaining pilot and cause destruction of the a/c. Yes, a slim chance, but the point is that no system is foolproof.
How about a "dongle" or key slug, or other removable device the captain can take with him when leaving the cockpit which would disable the capability to disable the external key pad? The door could still be locked, but not disabled until the pilot returned and re-inserted the device back into the console. This idea is not fool proof either, but it would be relatively cheap and would have prevented this particular crash.