In addition to the other two suggestions, there is another possible approach: move all of your custom-app functionality out of the Theme, and into a hosted web service, to which the Theme connects via API key. That way, redistribution of the Theme itself does not impact your custom app-based business model, because the app would require Theme plus valid API key.
This approach may or may not work, depending on the nature of your custom app, but it is a successful model for some commercial Plugins, and is fully GPL compliant.