If by cold, you mean that the private keys never touch a computer connected to the internet, I believe it is possible but would be very cumbersome.

Basically you would have a lightning node on an online computer acting as usual but with a watch only wallet. When the node has to sign a transaction (which it has to multiple times for a single payment) you would have to transfer that transaction to the offline computer to sign and then relay that data back to the online lightning node.

So practically it doesn't really work.

Anyone feel free to correct me if I'm wrong.