Contrary to popular belief, NAT is not a firewall
NAT is a specialized type of firewall functionality; it routes based on the retained state of outgoing connections instead of on a static ruleset. That being said, it's no substitute for the flexibility of a fully configurable firewall with advanced security measures (e.g. dropping all packets from a particular host if it sends to more than a few denied ports or otherwise engages in immediately recognizable misbehavior). So yes, a NAT router is a firewall, but not necessarily a very good one.
dropping packets does not make you completely invisible.
Nothing makes you completely invisible if you are communicating with a system that the attacker controls, or if the attacker has out-of-band information to confirm the presence of your computer on the Internet. That being said, dropping unauthorized packets certainly makes your system less readily visible.
a hardware firewall is not inherently more secure than a software one
It is in some regard unless you can configure the software firewall to run in its own address space without access to the native IPC mechanisms of the system you're trying to protect (in some sense I guess this is almost the definition of a "hardware firewall"). Otherwise trojans can potentially take over the OS and disable the firewall.
A hardware firewall doesn't protect you from bad stuff going OUT of your PC.
Actually it can, but it's a pain in the ass to set up because your apps need to support an arbitration/authentication protocol (SOCKS) and management of the authentication comes with its own set of security concerns.