More than likely, as the driver holds the button on the phone, the phone sends a message with the command, at a decently fast rate. If the message stops coming in, doesn't come in within an acceptable interval, comes in out of order (possibly indicating a bad line of site), or signal strength is low. If any of this happens, the car exits summon and the driver has to re-enable it if they want to.

You hope the car relies on continuous signal from the phone to proceed. It's certainly possible that the phone freezes in a way that the "keep going" signal continues to be sent, but it's probably not the more likely failure mode. Definitely a good thing to be concerned about!

> we can be absolutely certain

Such a thing does not exist. You can only add more nines (e.g. heartbeats, check sensor jitter etc.). At some point you're more likely to be ran over by another car than the tesla slowly, patiently crushing you at 2km/h.

Of course that doesn't mean tesla is actually that reliable.

"keep going" button = Dead mans switch [1]

https://en.wikipedia.org/wiki/Dead_man%27s_switch