A password of 13 alphanumeric characters CAN be robust enough to ensure security. There are 6213 such passwords, a number which is close to 277. If you choose such a password with full uniformity (i.e. you generate all 13 characters independently from each other, using a strong random source, i.e.
/dev/urandom or some dice but not any biological brain), then you have 77 bits of entropy, and brute-forcing that is on the verge of the possible. That is, it could be done, but it would be expensive (cost in dollars would rise to the billions, not mere millions). In that sense, setting a 13-character password for your home WiFi should not impact your security too much, if you do it properly.
A limitation to 13 characters screams of WEP. WPA and WPA2 can use any password length between 8 and 63 characters; a password length limited to 13 (a weird value in the absolute; developers prefer powers of 2) probably means that the thermostat will want to connect to your WiFi with WEP.
And that is bad news. WEP has a very poor design and can be easily broken through with software which is readily available for free, regardless of how random the password is. It is probable that even with the 13-character password, the thermostat won't connect until you configure your router to allow WEP, and that would punch a hole in your security. A big hole. Rather a four-lane tunnel, really.
It is relatively easy to check, though. Set a 13-character password but without enabling WEP, and see if the thermostat can work with that. But if you value your network security, do not enable WEP. Never.
(If you really must make this thermostat work and if that cannot be done without WEP, then you might consider buying an extra WiFi router, for the benefit of the thermostat alone. Then link that extra router to your network with a firewall in-between, blocking everything except that which is strictly necessary for the thermostat to do its work.)