Obviously we have to assume that public wifi is compromised in any case and require transport-layer security, but I can certainly see there's still a gaping security hole there.

Agreed on the security hole on public wifi, though it's probably about less "sensitive" data as HTTPS is becoming more of a standard, especially after the Snowden revelations.

Most services/apps speak HTTPS nowdays and a lot more will (hopefully) follow: https://letsencrypt.org/

Is there any reasonable way to deal with this issue?

So, yes with HTTPS