Your router uses Network Address Translation (NAT), which is an extremely secure form of firewall. Unless you do port forwarding on your router, you can have your Mac wide open and nothing from the Internet can connect to you. There's not necessarily a reason to turn off the Mac's firewall, unless you are attempting to run some sort of server on the Mac (trying to troubleshoot firewall and port forwarding problems can be a pain in the ass if you're running a NAT router and a firewall at the same time), but the Mac's firewall isn't actually doing anything.
This assumes you're using a strong password on the router, of course, and there's no hostile attacker on your wireless network. If there's an attacker on your local network using your wireless access point, then the router's NAT firewall doesn't protect you.
Using public WiFi is a complicated issue, and it depends on what security threats you're concerned with.
Even on public WiFi, the router is protecting you from attackers on the Internet. What it does *not* protect you from is an attacker on the same public WiFi--that is, an attacker sitting next to you in the coffee shop or behind you on the airplane.
An attacker on the same public WiFi can "see" information traveling between your computer and the wireless access point. If you are connected to a secure Web site (using https), that doesn't really help him very much; but anything you do on a Web site that isn't secure is wide open and can be seen. There's a great demonstration of this--a program that will display every image that anyone sharing WiFi with you is looking at, if they're using Web sites that aren't encrypted.
Your Mac does not, by default, expose any server processes that can be remotely exploited, but running a firewall is still a good idea when you're on public WiFi. Far more important, though, is making sure everything you do--browsing the Web, using instant messenger apps, sending or receiving email--is done on a secure link. If you're browsing unsecured Web sites, using non-encrypted IM programs, or fetching email without using SSL, then you should assume that everyone in the coffee shop can potentially view whatever you're doing.
