Each module has six groups connected in series, and each group has dozens of cells connected in parallel, each cell with its own tiny fuse (see the pictures in the article). If one cell shorts, the fuse removes it from the group, while the rest of the cells in the group is enough to keep it working. And the active cooling removes the heat released from a failing cell, so it won't overheat its neighbors.
I've long thought that one of the reasons Tesla built their own battery factory is so they can be absolutely assured of the consistency of the batteries. If the charge rate, discharge rate or internal resistance of an individual battery varies from the others over time, that's when battery packs tend to catch fire. Well, one of the reasons battery packs tend to catch fire, anyway.