What is the number one thing for a startup to do to prepare against patent trolls?

Identifying known patent trolls (they usually have track records) who own enforceable patent assets relevant to your field, and obtaining a freedom to operate opinion in light of those assets, may be prudent. Doing the same for your direct competitors is also a good idea. This is more due diligence than a countermeasure, however. Actually "countering" patent trolls, or more accurately the lawsuits they bring, would entail successfully invalidating the patents they attempt to enforce or otherwise defeating their claims, and for that you will need legal and financial resources to defend yourself. Obtaining IP defense insurance (e.g., IPISC) may also be an option.