Even with more CPU power than the entire honest network, what can an attacker not do?

He can't create coins from nothing or steal coins he never owned — honest nodes reject invalid transactions. The only attack available is rewriting his own recent history to double-spend money he just spent.

Nodes never accept invalid blocks or transactions, so inflation ("value out of thin air") and theft of others' coins are simply impossible no matter how much power an attacker has.

The single thing majority power buys is the ability to out-race the honest chain and reverse one of the attacker's own recent payments — take back money he already spent. That's the real meaning of a "51% attack": double-spend your own coins, not steal everyone's.