Well, I've discovered the answer to my second question. 

This is a new machine I built in January and I thought I had applied all the Windows Updates.  Not as such.  The missing one was KB967715.  It creates an extra registry entry alongside the "NoDriveTypeAutoRun" one under Explorer - it's called "HonorAutorunSetting" and should have a value of 1.  It fixes exactly the behaviour I had experienced where the autorun.inf is executed by Explorer on a right-click.

So be sure you have BOTH entries in your registry for Autorun/Autoplay to be effectively disabled.

Scary stuff.