How can a light client be certain he got all relevant transactions?
It can't. However, it is sufficient to request the information from a single honest peer, as the proof does work in the other direction.

This is one of the major drawbacks of using BIP37 for learning about transactions (other downsides include terrible privacy and high load on the servers you're fetching from).

Several proposals exist to improve this, including Committed Bloom Filter and committed adress-indexed UTXO sets. None of them have been implemented, however.