Keep the boot sectors for Linux and Windows separate. Windows loves to fubar the Linux boot instructions during update. They somehow still manage to break the Linux boot section even when it’s on its own isolated sector, but it happens a lot less frequently.
AFAIK you can’t use drive encryption when dual-booting on the same HDD.