They are in the business of selling domains. That means volume is king. They want to move as many units as possible. The idea that they would 'steal' a domain from you right before you were about to pay them money for it is absurd.
They would only be stealing from themselves, by purposefully denying a sale they were about to make. They receive no value by taking domains and sitting on them, or speculating or whatever. They do receive value by making a sale. Sounds like a good way to lose money.
It's much more likely that 10,000 other people had the same idea to get something as popular as 'dnd.quest', than Namecheap 'stole' if from them while it was in their shopping cart.