Is WPA2 WiFi protected against ARP poisoning? If not, can the ARP poisoner decrypt the packets?
WPA2 is NOT protected against ARP poisoning.
When you perform ARP poisoning, you announce that your MAC address is responsible for a given IP address. All of this happens at a layer higher than WPA2 is aware of. Let's say layer 3. Because the WPA2 encryption link is down on layer 2, and packets destined for the attacked IP are now addressed to the attacker's MAC address on layer 2, they will be encrypted for the attacker.
Edit: Also, one should be aware of "Hole 196".