Counterfactual Explanations with Probabilistic Guarantees on their Robustness to Model Change