The short answer is, it depends on how you choose your passwords, and on how the software derives the encryption key from the password.
As you've correctly noted, AES is almost never the weakest link in your encryption system. So far, nobody's found (or, at least, published) any way to break AES itself significantly faster than by trying all the possible AES keys by brute force. Doing that for an AES-128 key is far beyond the means of mankind; brute forcing an AES-256 key, at least using conventional computing technology*, should be well beyond the means of any civilization limited to a single star system.
On the other hand, guessing a password can be much easier than that. Exactly how much easier depends on how you choose your password. If your password happens to be, say,
abc123 or anything else found on some list of most common passwords, it basically takes no time at all. Even if you, say, pick an obscure word and mix it with some numbers and punctuation, there are password cracking tools like John the Ripper that can very quickly try all combinations like that.
On the other hand, it's not actually hard to come up with a password (or, more properly, a passphrase) that is as hard to guess as a random AES key. For example, a 10 word random Diceware passphrase has a little over 129 bits of entropy, making it about twice as hard to brute force as an AES-128 key.
Sure, a random 10 word passphrase takes a bit of effort to memorize, but not as much as you might think. Here's one I just generated (using
/dev/urandom and a Perl script, since I don't happen to have actual dice around):
paso stew glans statue north max admix gloat frau betsy. I bet if you really wanted, you could memorize that.**
In practice, even a shorter passphrase should be sufficient for most purposes. A 6 word Diceware passphrase has about 77.5 bits of entropy, and while brute forcing it might be within the reach of, say, the NSA if they really wanted to, your secrets would have to be absolutely vital to national security for it to be worth the effort. Some random hacker who's just after your credit card number or your Steam account has nowhere near such resources available.
Besides, as I mentioned earlier, there are ways for crypto software to slow down brute force password cracking attempts, by using a deliberately slow key-derivation function to convert the password into an encryption key. This is known as key stretching, and any decent cryptosystem that uses passwords should implement it.
Since you specifically mentioned AxCrypt in your question, I took a quick look at their site to see how they claim to process passwords. Under "Technical Details", there's a link to this PDF, which says:
Password derivation algorithm
The password is UTF-8 encoded without BOM. It is then passed to a PBKDF2-HMAC-SHA512 key derivation function. 64 bytes of output are produced and then reduced to the target key size. The salt is 32 bytes, and the iterations are set to a fixed value of 1000.
So it seems they're using PBKDF2 with an iteration count of 1000, which is... better than nothing, at least. The 1000 iterations basically slow down brute force password guessing attacks by a factor of 1000, compared to just directly hashing the password with SHA-512. So if, say, an attacker could crack your password in one second without the iteration (which is likely, if it happens to be one of the 1,000,000 most common ones or some simple variation of those), then with the iteration they'd have to spend almost 20 minutes to break it. Or, to look at it another way, slowing down a brute force attack by a factor of 1000 is about equivalent to adding one extra word to a Diceware passphrase.
That said, good modern crypto software would make the iteration count adjustable, and (for desktop use) default to at least 1,000,000,000 or so. That's almost equivalent to adding three words to a Diceware passphrase, or slowing a one-second attack down to 30 years. It's also about the number of hash iterations that a typical modern CPU should run in a little under a second.
If the software is really well designed, it may also use a memory-hard key derivation function that is designed not only to be slow, but also to consume a lot of memory, making it hard to implement on massively parallel password cracking hardware. But such functions have only really become popular in the last couple of years.
With a well chosen password, possibly helped by a good key-stretching KDF, it is in fact possible to ensure that your password won't be the weakest link in your cryptosystem, either. Of course, in practice, that doesn't mean that the system will be unbreakable; it just means that something else will be the weakest link, instead.
*) One potentially valid reason to prefer AES-256 over AES-128 is post-quantum security. If efficient general purpose quantum computers ever become available, Grover's algorithm could be used to search an $n$-element key space in $O(\sqrt n)$ time. That could potentially put breaking AES-128 within reach, but AES-256 should still remain at least as secure against such quantum attacks as AES-128 is against non-quantum brute force attacks.
**) General memorization tips (not just for passwords!): 1) don't think of the words in the passphrase as just words, think about what they remind you of; 2) don't try to memorize each word separately, but try to associate a mental image with each pair or triplet of consecutive words, so that each word will remind you of the next one; 3) use whatever mnemonics you can come up with — the weirder or more embarrassing they are, the better they work; 4) once you think you've got the whole phrase down, wait 15 minutes and try to recall it again; keep a note in case you forget. Then wait an hour and see if you can still remember it; then a day; then another day; and so on, until it's firmly lodged in your long-term memory.