First you need to set up your network name with one that is unique to you. Change that default name. Don't use something like Home or MSHome, everyone has that.
Your router has an internal firewall, if you want extra protection, yes install additional firewall. I would turn off XP's firewall though if you have Windows XP. Their firewall's a joke. If you have Roadrunner for your access, you can get EZ Armor for free. Black Ice is a good firewall. That's what we use at work for our internet banking site.
Get a good antivirus software. McAfee or Norton is good, EZ Armor has it included too.
Get spybot, ad-aware and run them religiously.