Although there might be a sweet feeling of revenge and justice in doing this, I am not sure it is either the most ethical or the most effective way of dealing with the situation.
Assuming the thief is just being nasty to your friend and is not stealing the food because he is hungry, he should probably be confronted by the person who is most likely to have influence over him. For example, his Rabbi, father, you, your friend or someone influential you can think of - or all of the above. The rebuke should also be done in private in a way that does embarrass the thief, but that is nevertheless effective.
I don't know of permission to harm someone who is not causing physical harm - unless the thief is caught in the act and then it is okay to physically stop him - nor is it going to necessarily help to put something in the food. Let's say he gets sick. Then what? He still might go on stealing from your friend, thinking that the stomach ache was due to something else.
Directly confronting the person is the most effective way to resolve the problem. It requires tact and to be done carefully, but the extra effort will, God willing, pay off.
