My understanding is that the 51% attack only requires more than 50% of the total hashpower. It doesn't require control over a majority of nodes.
Nodes each choose the chain with most work as their active chain. If one miner can produce more work than the rest of the miners combined, they can produce a chain with more work than any alternative chain.
Attack detection and reaction
So far as I know, the broad ecosystem of wallet software is not able to explicitly detect an attack of this sort and automatically apply countermeasures consistently.
the human operator of the software may be able to apply some measures such as block invalidation, but I believe every person operating a wallet or other node would have to do this manually. It is likely that people who choose a wallet for ease of use do not actively monitor bitcoin news and would not react in a timely manner. Since there is no established system of coordination between ordinary users, the network would presumably fragment. At least initially. It seems likely this would develop into a major issue with significant long term technical, community and reputational consequences.
The countermeasure to the 51% attack is not a reactive one but more of a preemptive one - it is considered very difficult for one person or organisation to suddenly amass 51% of the network hashpower.
I guess if the more vigilant members of the Bitcoin community detect some gradual centralisation of hashpower rising towards 50%, the response is possibly to engage more people in diversifying hashpower and perhaps develop new measures that aren't currently automatic.