MAC Whitelisting as well as Blacklisting are pretty much useless for security. Your strong WPA/2 passphrase however is great (if WPS isn't enabled).
As kub0x said, the Layer 2 info isn't encrypted. MAC addresses are fully visible: If you have a laptop or a wifi card, install or VM a linux distro and fire up the aircrack suite. With Airodump-ng, you can see the MAC addresses of WAPs and the MAC addresses of the clients. MAC spoofing is easy, so an attacker could definitely spoof the unencrypted MAC.
As for free internet, I'd say no. While they would masquerade as a whitelisted MAC address, they still wouldn't be able to decrypt the payload sent to them. Your strong passphrase has already encrypted the useful part of the data. Before they can get free wifi, they have to be able to send properly encrypted data to the WAP which it would decrypt. If it decrypts to gibberish (which it would if improperly encrypted, or not at all encrypted), it won't go anywhere. Further, in order for them to receive data from the router, and further the internet, they would have to decrypt those encrypted packets. Again, they wouldn't go anywhere.
The only chance they have of getting free internet with a MAC whitelist enabled is the same as if you had no whitelist enabled: they have to have your passphrase, or break in another way (WPS and Reaver).
The only thing MAC Black/Whitelisting does is prevent accidental connections to your WAP. Aside from that, I believe the listing does nothing.
Bottom line: you're still safe, but possibly not for the reasons you think.