You can safely place your robot.txt file as well as the sitemap.xml file into your websites root directory and NOT the WordPress directory.
When a robot visits your site, the first place it checks is http://sitename.com/robots.txt, hence you want to keep these files at the root of your domain.
You can also disallow what the robot has access to
User-agent: * # applies to all robots
Disallow: / # disallow indexing of all pages
Disallow: wordpress/wp-admin/
Disallow: wordpress/wp-includes/
Disallow: wordpress/wp-content/plugins/