How should unused I/O pins be configured on ATMega328P for lowest power consumption?
After digging through the datasheet, I found this:


  14.2.6 Unconnected Pins
  
  If some pins are unused, it is recommended to ensure that these pins have a defined level. Even though most of the digital inputs are disabled in the deep sleep modes as described above, floating inputs should be avoided to reduce current consumption in all other modes where the digital inputs are enabled (Reset, Active mode and Idle mode). 
  
  The simplest method to ensure a defined level of an unused pin, is to enable the internal pull-up. In this case, the pull-up will be disabled during reset. If low power consumption during reset is important, it is recommended to use an external pull-up or pull-down. Connecting unused pins directly to VCC or GND is not recommended, since this may cause excessive currents if the pin is accidentally configured as an output.


update in relation to comment/question:

According to table 14-1, the pull-up resistor is only active when the the following conditions are satisfied:


The pin is set as input (DDxn bit is logic low)
PORTxn is set logic high
PUD is logic low


The only way you'll get significant current flowing through the pull-up resistor is if the pin experiences a low level with the pull-up enabled. This means either Atmel messed up badly (unlikely) or you have the pin configured as input with the pull-up enabled and the pin is somehow connected to ground.

Section 14.2.5 discusses digital input enable and sleep modes. To summarize, the digital input is clamped to ground at the input of the Schmitt Trigger to prevent a floating level while in sleep mode, unless the pin is configured as an external interrupt. I can't tell if digital output is disabled in sleep mode. It doesn't look like it is disabled according to figure 14-2, though I wouldn't be too surprised if it was. The best bet is to use either an internal or external pull-up resistor.