Essentially there is nothing (in Tendermint) that prevents anyone to access the database or harddisk directly and selectively overwrite parts of the record data.
Correct
Is the complete chain validated at all times (whenever a new block is being added)?
No it is not.
How Tendermint prevents these kind of situations?
Currently it doesn’t. If someone tries to gossip such a block, it will not be possible to validate. For instance if your node is so compromised, and I’m downloading blocks from you, I will mark you as a bad peer for sending me this bad block.
This isn’t something we can really deal with short of running an integrity check on the entire blockchain all the time.
We could add support for something like that in the future, but it’s not really a priority now because you can always remove your data and resync from the network.
For this to be a problem, the attack would have to compromise more than 2/3 of the validators. If they manage to do so, well, to some extent they deserve to win 
That said, it would be interesting to add such integrity checking in the future. I think other databases do this under the guise of “anti-entropy”. It’s something we should look into one day, but I don’t think it’s really been a problem for any existing blockchain networks yet either, and they would have the same issue.