VPN is a good plan.
If you're connecting using an https connection to the site in question, the connection SHOULD be secured between your laptop and the providers server, stopping packet sniffers.
That said, a lot of sites don't implement SSL properly and only encrypt part of the traffic, then send a session cookie back in the clear. This means someone can hijack your session.
If you need to upload / download to a web account your really care about, you shouldn't be using FTP anyway. If you have SSH access on the account, you can download a programme called WinSCP, which will give you proper point to point secured access between your laptop and your webserver.