I swaped the 128GB SSD for a 512GB one and it works fine. To be precise, it's a Transcend M.2 SSD 430S 512GB (TS512GMTS430S) [1], simply because it was the cheapest and biggest compatible SSD I could find.

I also found a matching bag or rather case. It's a RivaCase 7511, which has a hard shell. [2]
According to [3] the dimensions of the GPD are 153x113x23.5mm, which is almost identical to what I measured (155x110x25mm).
The RivaCase is supposed to have interior dimensions of 160x110x45mm, so it's pretty close.
Unfortunately when the case arrived, I found it could either fit the GPD in width or in depth, but not both at the same time.
So I decided to brick it (see photo! ) and now it fits perfectly.
The power adapter is 25mm thick, so in theory it shouldn't fit in the 45mm height of the case as seen in the photo, even if we account for the 23.5/25mm of the GPD being measured at the hinge. But it does. I can feel the power adapter touching the GPDs lid when closing the case, but I don't have to apply any pressure.
For the moment I need some flat tool (e.g. the bottle opener of my swiss knive) to slightly lever the GPD out of the case. Let's see if it gets better over time. I just hope it won't get worse.
(edit: The GPD has two VESA screw holes on the bottom. One of them is pretty much in the center. I put a screw in it and attached an old lanyard I had left over from a camera. By this lanyard I can now easily pull the device out of the case.)
The black cable in the case is a slightly thicker 2m cable I bought. You can see the original white 1m cable on top of the bricks for reference.
On a side note, the RivaCase and an N900 in the CP-321 leather cover fit pretty nicely into Ortlieb's medium size "Saddle Bag Two 1.6L"). [4]

Kernel 5.2 has arrived in Debian unstable and it's based on gcc8. [5] I haven't tried it yet, but you should be able to install it under buster without the equivs dummy I had to use for towo's kernel.
The first update of Buster, 10.1, is scheduled for 7th of September [6]. I'd expect a buster-backport for the kernel around the same date, so you won't have to mix releases anymore.


[1] https://www.transcend-info.com/Products/No-981
[2] https://geizhals.eu/rivacase-7511-ac...-a1473584.html
[3] https://www.tomshardware.com/news/gp...ecs,38420.html
[4] https://www.ortlieb.com/de/saddlebag-two
[5] https://packages.debian.org/sid/linu...amd64-unsigned
[6] https://lists.debian.org/debian-deve.../msg00000.html