How can I place a Webserver in a private subnet in AWS and open it to the world on port 80

You typically would not use the NAT instance, which is really more correctly called a PAT (port address translation, a subset of NAT) instance, for this purpose. The NAT instance exists to provide instances on private subnets with outbound access to the Internet and most AWS services (for example, SQS or SNS) -- the outbound request traffic initiated by instances on private subnets (which only have private IP addresses, by definition) is masqueraded through the NAT instance's public IP address. It's possible to configure the NAT instance with static port mappings or more sophisticated access to internal services, either via iptables or by running a reverse-proxy on the NAT instance, but this is not the typical configuration.

Accessibility to the web servers via the Internet is shown in Figure 2 of the linked documentation. The Elastic Load Balancer, deployed in the public subnets, has public IP addresses, as well as private IP addresses. It accepts traffic from the Internet on the public side, and forwards it to your web servers on the private side.

The ELB provides a single logical point of access to all of the Instances inside from outside, and will not forward traffic to instances it does not consider "healthy."