they are locked down. the funds in a lightning channel are locked in a 2 of 2 multisig address, and can only be moved upon mutual consent (ie. by updating the state of the channel), or by one party after sufficient time has passed (in case of an uncooperative peer).