The scenario you suggest is theoretically possible. You can minimise the risk of it by using the Dropbox client rather than accessing Dropbox over the web. Your account will be pre-associated with your computer, and you will not be typing in your Dropbox password, so there's little chance of them grabbing it with a keylogger. Another possibility is to keep your password database on a Truecrypt encrypted USB key, or encrypted in some way on your iPhone rather than an online file sharing service, making it even trickier to get hold of your password file, as it will never be stored anywhere except where you physically are. Of course, if they have enough access to install a keylogger, they may well have enough access to grab your database file off your local storage anyway.
If you want to avoid password managers entirely but still have memorable passwords, then I recommend the approach advocated by University of Cambridge security researcher Ross Anderson. Create passwords by using the first letter of long phrases as this will enable you to generate long (i.e. difficult to crack) passwords that are still memorable. I actually use this technique (with modifications to increase entropy by including numbers and punctuation) to create master passwords that are very secure which I can remember. See http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-500.pdf for more details.
Any security measure you take will be a trade off between convenience and security. A highly paranoid user will never enter their passwords from a machine they do not control, and only ever send passwords over the Internet via https. Naturally this will limit the number of places from which you can access your password protected stuff.
Unless you think that someone is particularly likely to want your specific data, chances are any attacks on your password security will be low level trawls for low hanging fruit. As such the hacker is likely to be using automated tools, and is unlikely to go to the special effort of working out what password manager you're using, grabbing the password file etc. If you think you are likely to be a victim of targeted attacks, remembering separate high entropy passwords for all your sensitive accounts, and only accessing them from PCs you control with up to date antivirus and antimalware is probably the best way forward.