I'd like to remove the internet facing admin login on an RB5009, RouterOS 7.8.

Going into IP--> Services --> www and disabling port 80 unfortunately disables all web
traffic to the router, including internal. So it stops router management.

Is there a way to do this that will just block incoming login attempts from outside, but
leave the internal web connection on LAN intact?

Not that I can see. RB5009 out of the box allows www connections on port
80 to the router on the WAN side.

I've blocked www in Services and that stops outside logins, and I use
WinBox to connect internally on the LAN side, but I'd rather have port
80 connections to the router rather than WinBox so that I can connect
from linux - if there's a good way to do it.

Going into IP--> Services --> www and disabling port 80 unfortunately disables all web
traffic to the router, including internal. So it stops router management.

No need to disable it completely, but add the "Available From" values ? Eg. 192.168.x.y or multiple ranges that you want it to be "managed" from.
Not providing this value means : world wide open

In ADDITION, you should adapt your INPUT-chain to drop anything from the outside world hitting your Mikrotik that is not really needed.
So ALLOW inbound stuff like VPN/IPSEC/...
The last line would be a "drop" on the input chain in total, as other suggest too :

filter add chain=input action=drop in-interface-list=!LAN comment="defconf"

Thanks jvanhambelgium. This did the trick. The RB5009 routers we have
didn't have this locked down by default firewall rules.