Update: I found the bug. It was in my customized code and not in the two files mentioned above (tricky!). It turned out to be in

includes/templates/<my template>/templates/tpl_index_product_list.php

It had nothing to do with the original Zen Cart code. However, it seems that starting a <form> at the end of includes/modules/product_listing.php and not closing it in the same module, can be very confusing and can lead to pitfalls like this.