I have the same setup as you. What I do in order to avoid situations like the one you mentioned is to terminate the PPPoE on the ZS. The modem is in bridging mode, so all NAT tables are on ZS and it can send the answer back on the correct interface.
Otherwise you should somehow mark the incoming packets and make sure the answer will be sent to the same interface it came from with a policy based routing rule.