Closing unnecessary ports is a good first step, but the software running behind the ones that are open is just as important. For instance, SSH is generally considered a secure protocol, but it's still one of the most popular ways attackers try to exploit servers. It remains a popular avenue of attack not because it's inherently insecure, but because many admins get lazy - they don't bother to update the SSH server software to the latest version, ensure that all users have strong passwords, disable login from root, use certificates, create a lockout policy, etc. etc.
So as you can see, there are about a zillion things you can do just to secure SSH alone, and each one provides one extra layer of security. If you use all these measures, the chance that someone could still get in will be drastically reduced, but it will never be 0%. There's no such thing as a 100% secure system.
My point is, knowing which ports are open isn't really enough to definitively say whether your AP is secure or not. Your configuration details matter a lot, and there a ton of ways you can further increase the security of the services running on the AP. You have to find a balance - secure enough to (reasonably) be sure that no attacker would be able to get in, but not so secure that it greatly impacts usability.
Also, you seem to be focused on securing the access point itself, but what about the network that the access point is creating and the clients connected to the network? For example, you might want to implement WPA2-Enterprise or at least WPA2-Personal, enable client isolation, add a filter/IDS to prevent users from downloading malware, block P2P protocols and file sharing, add a usage agreement if this is a public network, block access to certain domains, log client traffic...things of that nature.
