brace-mr is now available via my Divested-RPM repo.
It inverts the kernel automatic module loading by blocking 4.3k kmods and instead provides an allowlist. There is a static built-in list + a dynamic list upon install/update.
Downside is any obscure devices you might use may not work without manually modprobing it.
Feel free to try it out or customize a similar approach using the sources.