What prevents a pool miner from stealing an entire block? As I understand it,when mining BTC, and calculating a block, the goal is to find a SHA-256 hash below a certain value (with the previous block, a nonce, and other things as the input).  Are pool miners all performing that calculation directly (just with different nonces?)

If so, what prevents the miner who "finds" the block from keeping it, and not reporting it back to the pool?  I'm assuming there's some safeguard here, and the miners aren't actually going to find the full solution.
When you are running a miner in a pool, you communicate through getwork protocol. It basically boils down to requesting work and sending back shares (and in rare cases, solutions to blocks). Work in getwork is a Block Header, not an entire Block. The coinbase transaction is encoded in the merkle root, but is not known to the miner. The block hash that creates a share or a block solution is ONLY valid for a given merkle root. If you change the coinbase, giving yourself all the money, you invalidate your solution and have to start over. If you are mining your own blocks, no pool should accept your shares (unless it is dumb).

To sum up - a miner does not know the coinbase transaction, nor can it change the block without invalidating it.

On the other hand, a miner can withhold a block solution while still submitting other shares. This will make the pool get less money while still having to potentially pay for those shares. This exploit can be detected by statistics though, so over a long period of time such a malicious miner can be found out.