It is true that many packets sent over WiFi be collected using ARP spoofing. Because ARP operates on the link layer of the OSI model, there is very little you can do about this.
What is currently accepted as best practice regarding Wi-Fi, is
- Use a properly designed security mechanism: WPA2, and
- Use a strong pre-shared key: 15 characters at minimum and randomly generated;
- Switch off the Wi-Fi Protected Setup (WPS) feature.
The pre-shared key must be random because a single handshake packet pair (challenge and response) can be used to crack the key off-line by using brute-force, dictionary, and/or rainbow table attack (or a combination of these methods), facilitated by the Aircrack-ng Wi-Fi suite, for instance.
You can read more about WPA2's vulnerabilities on Wikipedia. It reveals that you should switch the Wi-Fi Protected Setup (WPS) feature off, and that using a strong and sufficiently long shared key is imperative to avoid successful cracking of the pre-shared key by using brute-force over custom hardware (Aircrack-ng running on a FPGA).
Computers communicating over a WiFi connection (client-server) use the application layer of the OSI model, like TLS/SSL (and HTTPS). Using a secure application layer communication protocol (like HTTPS), adds an additional layer of security. So if your requirement is high security, this approach is certainly recommended.
VPN operates on either the data link layer (layer 2) or network layer (layer 3) of the OSI model, depending on the protocol that's being used. So, using VPN adds yet another layer of security.
These multiple layers of security is commonly referred to as Defense in depth. Of course, it is important not to share keys between each security system. You can be sure that if a hacker breaches the first layer by cracking the key, he or she will try to use it on each subsequent layer encountered.