One hopes the typical self-driving car isn't relying on just one model space in one software process. Surely these systems would have some mechanism for a robust, simple, safety-oriented software process that is continuously running and can take over at any moment, with the singular task of ensuring a safe stop.

It should be continuously preparing and revising a stopping strategy. It should even be able to do this with any half its sensors returning spurious or misleading data. Or even if all sensors are suddenly jammed, it should be able to blindly execute the stopping strategy prepared moments prior.