1 . Should I consider my primary key insecure?
It depends who you are trying to protect yourself from. AIUI based on the best known cryptanalysis 1024 bit RSA and DSA keys could be cracked by a well-funded attacker (I've seen the math run for RSA, not sure about DSA but AIUI they give similar security at a given key length) but it would probablly be cheaper to track you down and beat the key out of you.
Of course it is possible that government spooks have discovered cracking algorithms that are more efficient than the best ones that are publicly known.
For new keys generated now 2048 bit RSA is considered the minimum with the more security-paranoid groups generally recommending 4096 bit. Some prominent cryptographers even recommend going higher than that.
2 . If so, is there any way to replace it without revoking my entire key and creating a new one?
No, there is no way to replace the primary key other than creating a new one from scratch and telling your contacts to use it. Depending on how paranoid those you communicate with are they may accept a transition statement signed by your old key or they may require you to confirm the key is yours by out of band means.
It's also considered good pratice to sign the new key with the old key (but not vice-versa).
AFAIC most people don't revoke the old key immediately but I'm not sure what the pros/cons of that are.
3 . If my primary key were compromised, the attacker would be able to create signatures as me,
Yes
but they wouldn’t be able to decrypt information that was encrypted to my public key, right?
AIUI encrypted messages are encrypted to a particular subkey. The attacker would not be able to decrypt messages encrypted with your existing subkey.
They could mark your existing subkey as revoked, add a new subkey and upload the result to the keyservers. People who downloaded the updated key would then encrypt messages to the attacker's subkey. However unless they had total control of your communications it would be very hard for them to do this while remaining undetected.
q
? If it's only 160 bits, this is probably a weaker point than the 1024 bit modulus. If it's 224 bits it's clearly strong enough. $\endgroup$