Removing capabilities from cloned admin role

For a list of capabilities by user level, check the Roles and Capabilities Codex page.

The capability that would allow a user to change a theme header would probably be edit_theme_options, but I bet it would give your editors more capabilities than just messing with the header, though. It’s hard to say for sure without knowing what theme you are using.

The problem with creating a custom capability, on the other hand, is that unless you have access to the function which is creating the menu item which you want to allow access to, it won’t do you any good (and I don’t think custom headers, specifically, are a feature which you can tweak easily via theme functions, unless it’s an entirely custom-built functionality — i.e. not the one you will find in the default WordPress themes like Twenty Eleven).

So I’d say: clone the role and adjust capabilities.

To take capabilities away from a role, use something like this on your functions.php:

add_action('init', 'remove_unnecessary_capabilities', 10);
function remove_unnecessary_capabilities() {
    $caps_to_remove = array(
        'export',
        'import',
        'create_users',
        'switch_themes' // etc
    );
    $custom_role = get_role('admin_editor'); // Edit according to your role as it was declared when added
    foreach($caps_to_remove as $cap) {
        $custom_role->remove_cap($cap);     
    }
}

The code above will run every time a page is rendered, though the capabilities are recorded in the database. This doesn’t have any consequence other than adding unnecessary overhead, but if it bothers you, check the following answers: this, if you’re coding a theme; or this if you’re coding a plugin.