I don't know if you should have acted differently on this first act (supposing it was the first time). Taking into account you were not sure about how bad this was, I think you couldn't have made anything better at the time. Acting without being sure isn't a good thing, after all!
But it was indeed something bad, as your colleague could edit your texts to make you culprit of something. As direct as badmouthing your boss' mother, to as complex as making you the culprit of some money fraud. So, you should check what happened to your files, ask your colleague what he was doing, and request that he does not repeat this kind of action. Yes.
What I will say now isn't necessarily what happened, but it's a possibility you should consider:
Gossips can be (aren't always) a way to gain influence on the business, making the gossiper an ally of the boss, "denouncing" "lazy" or "unethical" workers (enemies of the gossiper). If this succeeds, the boss sees everything distorted due to disinformation, and the parasite gains power. Why did he want to look your documents? Is he collecting information about other people he want to attack later?
If you do not have the authorization to allow more people to see the documents, whoever who sees is breaching the orientation of your boss. He may know better how bad was this event, as he may know something not written that the gossiper can deduce and use. After all, the bosses have all information about everything, and only reveal what they want to - would they reveal "employee Y is stupid and I will fire it as soon as I can"?. Obviously your colleague will try to say you allowed by leaving the documents there, but he would be using you as a shield against it's own misconduct, and if you take any measure to make it clear you don't like this, you have your defense made.
To finish, don't your notebook has some kind of password to access? It should have. It's the first measure to prevent access. After this comes physical restriction, as your colleague could disassemble the notebook to access the data without needing passwords. Create one if you're allowed to, or talk to your boss about the possibility of it, if you were never allowed to do this before.