Synthesizing Robust Plans under Incomplete Domain Models