Formalising the Robustness of Counterfactual Explanations for Neural Networks