I agree with the others above. I think it probably matters less what you say than that you say something. I imagine they will be mostly blinded to the words, even cliches like “thoughts and prayers,” but they will register that you sent a note of sympathy and condolence.
If you can say something about the young man himself, so much the better—anywhere from “I loved his dimpled smile” to “You may not have known this, but Mark made a generous contribution to a charitable fund that I support. I’ll always remember his kindness.”
The main thing, I think, is to focus on them (“sending you love and comfort” rather than “I feel your loss”) and try to say it from the heart.
And I don’t think there’s such a thing as being too late with it. They’re going to feel this forever. It’s not ever going to be about reminding them; they won’t forget.