how soon do you have to renew your domain to prevent a takeover? Is there a minimum period or will your host contact you before selling it on ?
A domain will have an expiry date and you should always renew either before or on that day.
Once a domain expires it enters a "Redemption Period" - this varies depending on what kind of domain it is, co.uk, com, net etc
If after the redemption period it still hasn't been renewed the domain is listed for deletion.
Once it has been deleted then somebody else can immediately register it.
At no point should your host be selling the domain on unless:
A. You've told them you definitely don't want to renew it so they take it on themselves.
B. As soon as it has been dropped they immediately register it to themselves.
Best bet is to choose a host that do "positive renewals".
Some don't like this, however I use 123-reg and all of my domains automatically renew for a year if I do nothing (co.uk for 2 years as required).
If I want a domain to actually drop I have to check a box in my control panel.
This way my important domains keep on getting renewed even if I forget to do it manually.