Andy Hall wrote:

I can think of two solutions:

- A swing check valve in series with the pump. It remains closed
unless the flow from the pump opens it. Convection would not be
enough.

http://www.bes.ltd.uk/products/098.asp

I recently did exactly that, fitting a BES swing-check valve to stop
gravity circulation between a thermal store and a hot water storage
cylinder on the floor above. It didn't work. Gravity
circulation/convection exerts sufficient differential pressure to keep
the swing-check valve open; in fact, it made no discernible difference.

A spring-check valve may have worked. I'm going to amend it to plan B,
a NC zone valve.

- A zone valve arranged in series with the pump and powered by the
same supply. When you turn on the pump, the valve opens as well.

Yes, I'd recommend that. Fitting the immersion heater to the upper tank
is the best plan, IMHO.