Securing a wallet and multiple addresses
Yes, your "wallet.dat" contains all your keys, and when you make new keys then they will be added to your wallet.dat. If you encrypt your wallet.dat, then all keys in it will be encryptet and all keys added to it will also be encryptet.
Your founds is not stored in your wallet.dat. The founds are stored in the blockchain (which everyone can download via a huge p2p network).
Yes. Your wallet.dat only contain the private keys to spend coins. Everyone can at all time send you coins (whether your connected to the internet or not).
No. The USB stick will only be able to spend coins send to the first 3 addresses (as the USB stick's wallet.dat will only contain private keys to the first 3 addresses).
As long as your client has the longest blockchain, then coins send to you can NEVER be removed again (unless someone spends them, with the private key only you know). However note that coins can first be "trusted", when there is enough confirms ("0 confirms" just means that someone has sent you a transaction, but it will first be "trustable" when it's included in the blockchain and enough blocks confirms that the blockchain will never be forked under your transaction. But usually 6 confirms should be enough).
Type your address on a trusted website, e.g. https://blockchain.info/ and look at the balance. Some clients support "watch-only" addresses (they only store your bitcoin address and not your private key), but I don't think Bitcoin-QT supports this (yet).
I don't know much about litecoin, but most of the "public/private key" stuff, apply to all cryptocoins (e.g. you can watch an address without storing the private key, etc).