They say WordPress is GPL, and therefore all plugins and themes made with it are supposed to be GPL. Fine, but if I spent three months coding an extremely complex app theme with the intent on selling it repeatedly for profit, such as a medical office scheduling system theme, then how can I protect my investment, if even a moderate amount?
In addition to the other two suggestions, there is another possible approach: move all of your custom-app functionality out of the Theme, and into a hosted web service, to which the Theme connects via API key. That way, redistribution of the Theme itself does not impact your custom app-based business model, because the app would require Theme plus valid API key.
This approach may or may not work, depending on the nature of your custom app, but it is a successful model for some commercial Plugins, and is fully GPL compliant.