802.1X authentication (and the subsequent WPA key generation) involves three entities: A supplicant (the client), an authenticator (the access point) and an authentication server.
Like Zoredache said, the communication between the client and the authentication server is protected by public key cryptography (at least if you use EAP-TTLS or EAP-PEAP). It's not possible to pose as the original authentication server.
However, there is no direct authentication of the AP (the authenticator, in 802.1X language) to the client (the supplicant), or the reverse. The authenticator is only relaying messages between the supplicant and the authenticating server; all the fancy public key cryptography and mutual authentication provided by some EAP methods is transparent to the authenticator, and could therefore theoretically be intercepted and replayed by a rogue access point (MITM).
With basic 802.1X, there is indeed no protection against rogue authenticators - but 802.1X, when used for "WPA enterprise encryption" (EAP), provides additional security:
The WPA encryption key (which, among other things, enables mutual authentication between client and AP - which is what you want to protect against rogue APs!) for the connection is not generated by the access point, but by the authentication server, and is relayed to the client over the secured inner EAP channel. Of course, for the access point (=authenticator) to communicate with the client, it has to know about the key too, but it gets the key from the authentication server, and not the client.
In a normal configuration, the server will not accept authentication requests by any third parties; it usually only communicates with a limited set of authenticators, and the communication is usually encrypted (by a pairwise RADIUS secret). So for a MITM to successfully imitate a proper access point, the attacker would have to imitate the role of a valid access point against the authentication server.
Long story short, the protection against rogue APs is as good as the authentication and encryption between the authenticators (e.g. the APs) and the authentication server.
If you were to create a rogue AP, you could actually succeed in relaying the 802.1X authentication; however, you would not be able to read any of the clients traffic, as that would be encrypted with a WPA key unknown to you. Likewise, anything sent to the client by your rogue AP would be rejected by the client, as the WPA key is also used for message authentication.