I think that Cyanogenmod patched this.
As I said, I heard that Google patched it too, but I don't know how to find their patch.
Encrypting secret is useless, as attacker can replace Mycelium with fake and just wait for user to enter PIN.
Not entirely useless. I would enter my PIN maybe once a month, and not at all after hearing about an exploit like this until it was patched.
As it stands I am vulnerable - I literally don't know where the master seed is stored or how to protect it from the malware threat. But I'm pretty sure it's sitting on my device in plain text just waiting to be stolen. The only thing I've been able to think of is moving most of the coins out of Mycelium until this is patched.