I think you are limited to the size of the query not exceeding 20,000 characters.
SOQL statements can't exceed 20,000 characters. For SOQL statements that exceed this maximum length, the API returns a MALFORMED_QUERY exception code ; no result rows are returned.
Maybe someone can weigh in on whether this applies to bound lists - if just comma-delimiting a bunch of IDs, one won't get more than about 1000 in there.
Edit: @sfdcfox has run an experiment and concluded bind variables do not contribute to query length.
Edit: It seems that when using bind variables, the number of items in an IN clause is determined by the amount of available heap space.