In the first section of this answer I'll assume that through better hardware or/and algorithmic improvements, it has become routinely feasible to exhibit a collision for SHA-1 by a method similar to that of Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu's attack, or Marc Stevens's attack. This has been achieved publicly in early 2017, and had been clearly feasible (the effort represents mere hours of the hashing effort spent on bitcoin mining; but the hardware used for that can't be re-purposed for the attack on SHA-1).
Contrary to what is considered in the question, that would not allow an attacker not kowing the HMAC-SHA-1 key to make an undetected change in a document; that's including if the attacker is able to prepare the document s/he's willing to later alter.
One explanation is that the collision attacks on SHA-1 we are considering require knowledge of the state of the SHA-1 chaining variable, and the attacker of HMAC not knowing the key is deprived from that knowledge by the key entering on both extremities of the iteration of rounds in which the message stands in HMAC. A much deeper break of SHA-1's round function would be needed to break HMAC. Not coincidentally, M. Bellare's New Proofs for NMAC and HMAC: Security without Collision-Resistance shows that security of HMAC holds assuming only weaker properties on its round function than needed for collision resistance of the corresponding hash.
What would be possible is for an attacker knowing the HMAC key to prepare a document that s/he willing to later alter, that can be altered without changing the MAC. But since the attacker is holding the HMAC key, that's not considered a break of HMAC.
A comment asks when should SHA-1 not be used?
Original advise, 2015: It is advisable to quickly phase out SHA-1 in applications requiring collision-resistance (as an image: quickly walk away, as you exit a building which fire alarm rings when there's no smoke). That includes hashing for integrity check or digital signature of documents prepared by others even in part (which is, most documents). If continuing to use SHA-1 has strong operational benefits, it can safely be made an exception by inserting something unpredictable by adversaries before any portion of the message that an adversary can influence. For example, by enforcing an unpredictable certificate serial number at time of request of a certificate, a certification authority could still safely issue certificates using SHA-1 for their internal signature.
As explained in the first section of this answer, as long as the key of HMAC-SHA-1 is assumed secret, there is no indication that HMAC-SHA-1 is insecure because it uses SHA-1. If the key is assumed public, or its leak is considered an operational possibility where it is still wanted collision-resistance for HMAC including for message prepared after disclosure of the key, then the precautions discussed in the previous paragraph apply.
Update, 2022: As the saying attributed to the NSA by Bruce Schneier goes: Attacks only get better; they never get worse. The current state of the art finds a new collision in SHA-1 at cost comparable to $2^{61.2}$ hashes (comparing to $2^{69}$ for the first theoretical attack and $2^{63}$ for the first practical attack). More importantly in practice, a chosen-prefix collision (one with colliding files starting differently and arbitrarily) has become possible, with cost comparable to $2^{63.4}$ hashes, which is entirely practical. Such chosen-prefix collision attack (resp. variations) make it difficult (resp. essentially impossible) for even an expert to detect a planned-in-advance substitution of a document signed with SHA-1, or integrity-protected by HMAC-SHA-1 using a key known to the perpetrator. Still, every piece of advise given in this answer remains valid as far as we know.
