Anything that can be used to identify an individual either on its own, or in combination with other information that a data controller holds, qualifies as personal data under the GDPR.

A FF number is expressly designed to identify individuals and therefore falls squarely within this definition.

Obviously if the holder of a boarding pass decides to bin it, that's up to them. For obvious reasons, they aren't under any GDPR obligations with respect to their own data. But a data controller or processor could be in breach of the GDPR if they disposed of a customer's boarding pass in a careless manner.