Protect data while laptop is at repair shop

OS X Internet Recovery
Mac models introduced after public availability of OS X Lion include the ability to start up directly from an Internet-based version of the OS X Recovery system. OS X automatically uses this feature when the Recovery System on the hard disk isn't available (such as when your hard disk encounters an issue, or when your hard disk has been replaced or erased).

My setup is a Mac mini 2011 with a DIY Fusion drive (840 Pro + 1 TB Hitachi). The Fusion drive was built on 10.8 and then the machine was upgraded to 10.9.

diskutil list 
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *256.1 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:          Apple_CoreStorage                         255.7 GB   disk0s2
   3:                 Apple_Boot Boot OS X               134.2 MB   disk0s3
/dev/disk1
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *1.0 TB     disk1
   1:                        EFI EFI                     209.7 MB   disk1s1
   2:          Apple_CoreStorage                         934.5 GB   disk1s2
   3:                 Apple_Boot Boot OS X               650.0 MB   disk1s3
   4:       Microsoft Basic Data BOOTCAMP                64.9 GB    disk1s4
/dev/disk2
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:                  Apple_HFS Fusion HD              *1.2 TB     disk2

1. When I press alt, I get three entries, Fusion, Fusion, Boot Camp. Either Fusion being selected boots the main OS. Bootcamp boots Windows.

2. ⌘R boots local Recovery HD (not Internet Recovery). I have a choice of Wi-Fi, if I need Internet Recovery.

In your case, is it possible the Recovery HD is damaged?

You should have to remove an EFI password or permit them to reset that since it prevents Service Providers from network booting to diagnostic images or selecting an attached bootable volume to run test software.

You don't need to decrypt FileVault 2 in any service I've ever seen unless you want them to log in to your user account and look at your software. With physical access they can wipe a drive, make a clone/copy of it, but encryption is your way to protect the contents of the files reasonably well without impacting service testing.

My guess is that the person communicating with you mis-spoke or mis-understood the notes from the technician and if you call them back (or have AppleCare update the case notes and alert the technician), they can confirm if you have EFI locked firmware password set.

Apple documents this in the repair terms and conditions both online and you should have received them before signing the machine in for service.

Technically, they could wipe your drive and reset all passwords per the terms, but generally they give you a courtesy notice before doing so intentionally.

See: https://support.apple.com/en-us/HT203253

Despite my generally trusting Apple repair employees, I would not give a machine password to an AASP until I had a very good understanding of who in that organization would have access to it, how it would be protected and when it would be destroyed. As to an iCloud password, the bar for yielding that is far, far, far higher bordering on almost never ever.