Correct, once final a transaction can not be undone. Transactions sit in a pending state until they are final, and that state duration is dependent on a number of variables. Transaction that are in this state for too long are rejected.
So, how does this deal with a network split? I have yet to see any consensus proposal which is truly forkless without the ledger producing nodes being set in concrete, like they are in ripple.
I put it to you that forks are inevitable unless the nodes producing the ledger are a fixed set.