This is
public_html/.htaccess, and not
public_html/sub/.htaccess, right? You're still in the root (
public_html/) directory when this is executed, so $1 contains
sub/ and it's trying to redirect to
public_html/sandbox/sub/. Move this redirect into
public_html/sub/.htaccess and drop the first RewriteCond, and you should be sent to
public_html/sub/sandbox/ (
http://sub.domain.com/sandbox/). If you want to be sent elsewhere, give a full http://.... for the RewriteRule.
LP's internal DNS is going to send sub.domain.com to
www.domain.com/sub, so you can't avoid starting from there. Maybe you could ask them to put a custom entry in DNS, but they'll probably turn you down.