Yes, this pretty clearly establishes there's bounds: the search has to be tailored in scope to address a reasonable suspicion of a violation of school policy.
Can a school have a policy about cyberbullying outside of school, and pursue a search in that case? This is untested.
As I said:
"The exact limits of a public school's authority to search mobile devices, to handle events that have partially occurred outside school, has not been established."
