Your phone or laptop will not necessarily automatically connect to that alternate AP, because even though it has a known SSID, it also has a MAC address which does not necessarily match the one at your home. Whether a given system will be ready to disregard the MAC address change depends on that system (from an explicit experiment at home, I can say that Windows 7 will not automatically connect to a known SSID if the access point MAC address does not match). Of course, an evil attacker may have followed you home, stopping just outside of your door, and recorded the MAC address of your own WiFi AP, so that he could mimic it with his own fake AP.
Assuming that your phone/laptop does indeed connect, PEAP includes SSL/TLS, and this should protect you (subject to some caveats; see below). Basically, when using PEAP, the client (your device) opens a SSL connection with the access point, and will proceed to sending your username and password only after duly validated the access point's certificate. This mimics the situation with HTTPS Web site: the client first makes sure that it talks to the right server, and sends sensitive data only through the SSL encryption umbrella.
There are some subtle points with validation of the certificate. Revocation status will probably not be checked, because your device is trying to obtain its Internet connection, and thus won't be able to download a CRL yet. See the draft protocol for details. Also, it is a bit unclear how the client goes from "this is a valid certificate" to "this is a valid certificate for the access point I intend to talk to". I expect most WiFi/PEAP clients to record the certificate sent by the AP upon the first connection, and then to automatically reconnect (with the sending of username and password) only if the AP still sends the exact same certificate, or a certificate advertising the same server name.