Is it 'normal' to have 2 zone valves on an S-Plan with an unvented
cylinder?

Yes. It is a legal requirement. It is against the law not to have it. The
thermostat has to be non-self reseting (i.e. requires a "reset" button to
turn back on).

Building Regulations Part G3
3.3 To meet the requirement a directly heating unit or package should have a
minimum of two temperature activated safety devices operating in sequence:

a. a non-self resetting thermal cut-out to BS3955:1986 Specification for
electrical controls for household and similar general purposes, or to
BS4201:1979 (1984) Specification for thermostats for gas burning appliances;
and

b. (snipped description of temperature/pressure relief valves).

3.6 Safety devices listed in paragraph 3.3 (see also 3.4) for direct heating
are also required for indirectly heated units and packages but the
non-self-resetting thermal cut-out should be wired up to a motorised valve
or some other suitable device to shut off the flow to the primary heater,
that is:

(snip list of approval methods).

Christian.