Ah, I see what was wrong with my answer then. I was assuming that you had two separate fields, but it sounds like you're using a single multi-select field. So when they check both boxes, the literal string value stored in the database is actually "value1,value2".
It sounds like you have it working. In general I would probably do this with two separate fields, just to avoid this sort of problem, but if it's working for you now don't change it!
The way I would advise setting this up, if someone is doing this from scratch, is to have two completely separate binary fields, one for "RSVP Lunch" and another for "Free Pass Giveaway." These fields can have values 0 (unchecked) or 1 (checked). Then build the conditions as I described above, and there will be no syntax ambiguity in your conditions.