That risk is 100%.
No, not really. But as a general rule, if you don't cover for those kind of exceptions they will occur. And at the worst possible time as well.
The easy thing is to let the database handle it, something like this:
update stock set stock = stock - 1 where id = x and stock >= 1
In PHP you then check if the row was updated or not. This is 100% safe (assuming that you have just one database server).
