This is a defence in depth issue
Any given sensor can be jammed or be fed data that is valid (to the sensor), and we must assume that a bad actor will do those things, and sometimes with multiple attack vectors.
The various mechanisms to deal with it come from many backgrounds including defence, avionics and systems and network architectures to name but a few areas of research.
From my time working with flight control computers, the first line of defence when a sensor was jammed (these are normally triplex systems, so the system voted) was to ignore the outvoted unit and reset that channel.
With sufficient sensors of a given type it should be possible to determine whether an attack is taking place (the data for the different radar / lidar sensors would not be the same under normal conditions so an attempt to inject data would result in a detection for a 3 or 4 channel system).
This would require that the sensors are being compared for such things, of course. Whether that is currently being done is a question I cannot answer.
With sufficient different types of sensors (which would all be multiple units for basic safety anyway), it should be possible to defend against both jamming and data injection attempts if the algorithms to identify implausible inputs are properly defined; this is an area of intense research.
During an attack event, the rules (known as control laws in avionics and seem quite appropriate for self driving cars) might need to be relaxed to ride through the event. The three fundamental types of control laws may be found in the previous link.
One example of where injected data would be implausible is a 3 beam doppler radar (often used for navigation), where the only time all 3 beams would return the same result is if the vehicle is not in motion; combined with other sensors, an attack could quite easily be detected.