I realize there is no Anti-Virus software for Windows Phone and it is not needed - but why exactely? What specific safeguards are in place? Is there device encryption and what does "sandboxing" mean? I'd appreciate some references if possible.
Viruses and other malware rely on a couple of key features - the ability to run in the background, and the ability to self replicate (in the case of viruses) or access sensitive information from elsewhere on the system (in the case of malware)
Like in iOS, but unlike Android, Windows Phone applies the principle of defence in depth. Apps are screened prior to being included in the official store; apps can only be installed from the official store (with the exception of development unlocked phones). Apps are restricted as to what they are capable of doing, for example, custom keyboards (that could contain malware, or be open to attack) are not possible - background apps are limited to scheduled timeslots, and things like media playback. The sandboxing element is a term to mean that apps cannot interact with each other's data - they each run in their own metaphorical sandbox.
All combined, this approach covers most of the risks (there may always be an avenue for attack) associated with malware and viruses - screening should filter out malware, but if it got through that layer of defence, it couldn't self replicate onto other phones, and even if it could, it couldn't steal sensitive data from your other apps.
This doesn't mean that you should be complacent, and I would always advise only connecting to WiFi networks you trust, not authorising apps to connect to your online social networks unless they have a good reason to do so, as well as following the normal online safety guidance.
To add to @RowlandShaw's excellent answer, Windows Phone also mandates signed binaries for most purposes. Some stuff can't run in a sandbox (either because they are core OS components that need to be able to access everything, or because they are specifically added to provide ways for trusted apps to do a limited selection of stuff outside of the sandbox). While ordinary developers can't install such things (un-sandboxed EXEs or drivers, and the libraries they load) in a normal situation, Microsoft and OEMs can (and do).
However, due to bugs, somebody might be able to produce a malicious modification to such components. If they could find such a hack, and deploy it against your phone, then they could potentially get un-sandboxed code running on your phone, which would give them complete control. However, the modified code won't actually run, because Microsoft requires that all non-sandboxed binaries on Windows Phones be signed with code signing keys that only Microsoft has. You can't even replace the component that does the signature checks, because its signature is checked by a lower-level part of the boot process; the chain continues quite far down.
The fact that this also restricts the supposed owners of the devices from running their own code without the restrictions of the sandbox is evidently not that big a concern for Microsoft.