Sadly, my 250th blog post isn't fully an original post but just a link to an awesome blog post someone else wrote, but it's a good read:
Find My Mac
The only two things I'll add are these:
If you want to clear everything out (say, if you're re-imaging a machine... not sure why you'd want to keep any firmware variables around), you can run
sudo nvram -c
which will delete all firmware variables.
If a user signs out of her iCloud account before you re-image a machine, it will clear out the fmm-mobileme-token-FMM firmware variable but not the fmm-computer-name. That's likely sufficient to prevent a future lockout, but you may want to run the previous command to clear out all firmware variables just in case.