It can be done but it is convoluted. Root volumes can be replaced on a running instance using a snapshot or an image. If you create a snapshot from a newly encrypted volume, however, it will result in an error. But, you can make an image from that snapshot and then the root volume can be replaced without stopping the instance. Here are the steps:
Create a snapshot of the unencrypted volume
Create a volume from the snapshot and add the encryption key. IMPORTANT: root device name must be the same. ie: /dev/xvda
Create a new snapshot from the encrypted volume
Create an image from the encrypted snapshot
Replace root volume with new image: Actions > Monitor and troubleshoot > Replace root volume
One thing to note is that you can't change encryption keys with this method, only add one. To change it, the instance must be stopped.
Some useful tips:
keep track of ids
use tags and descriptions to keep track.
make sure snapshots and volumes have finished and are available.
make sure new image has same settings as the original instance.
More info here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html