“Any router+firewall from any big box electronics store will protect your XP well enough. (”
Thats just not true. A basic firewall is certainly good but it will hardly protect you from application based malware or hacks.
“it will hardly protect you from application based malware or hacks”
Will if you turn off the power. ;^)
Nothing will protect you from application-based malware except a locally executed, periodically updated antivirus that is hooked into the Windows kernel and intercepts OpenFile/OpenFileEx API calls. It works the same on any Windows, from Win95 to Win8.1. The antivirus software is available from many vendors, and it runs on XP just fine (and will continue to run, as long as the vendor has enough XP users.)
IE is yet another channel of virus distribution. Get rid of it by blocking it with a firewall (Sygate, ZoneAlarm and others allow you to block individual applications.) Run Firefox with AdBlock and NoScript addons, and drive-by payload will have no chance to even get downloaded, let alone run and escape the JavaScript sandbox. Your Internet experience will improve dramatically. Firefox is supported and updated regularly, so this channel of intrusion should be blocked on all platforms (XP and Win7/8/9.)
In my use scenario XP boxes are not used for active Internet browsing. They instead have industrial use - they run certain equipment. Nobody touches them for weeks, and certainly nobody surfs the Internet with them. Other people may use XP for Internet browsing, but very simple measures will ensure (well enough) that the computer is safe. Those measures equally apply to any version of Windows.