I messed that up; size vs. index of arrays (arggh). Changes are highlighted in red. Note that the result still might be incorrect if the navigation history in the session is empty and the HTTP_REFERER is the current page.

Code:
////
// Set back button
  function zen_back_link($link_only = false) {
/*-BOF rewrite lat9
    if (sizeof($_SESSION['navigation']->path)-2 >= 0) {
      $back = sizeof($_SESSION['navigation']->path)-2;
      $link = zen_href_link($_SESSION['navigation']->path[$back]['page'], zen_array_to_string($_SESSION['navigation']->path[$back]['get'], array('action')), $_SESSION['navigation']->path[$back]['mode']);
    } else {
      if (isset($_SERVER['HTTP_REFERER']) && preg_match("~^".HTTP_SERVER."~i", $_SERVER['HTTP_REFERER']) ) {
      //if (isset($_SERVER['HTTP_REFERER']) && strstr($_SERVER['HTTP_REFERER'], str_replace(array('http://', 'https://'), '', HTTP_SERVER) ) ) {
        $link= $_SERVER['HTTP_REFERER'];
      } else {
        $link = zen_href_link(FILENAME_DEFAULT);
      }
      $_SESSION['navigation'] = new navigationHistory;
    }
*/
    $link = '';
    $nav_last = sizeof ($_SESSION['navigation']->path) - 1;
    if ($nav_last > 0) {
      $back = $nav_last - 1;
      if ($_SESSION['navigation']->path[$back]['page'] != $current_page_base || (--$back) > 0) {
        $link = zen_href_link($_SESSION['navigation']->path[$back]['page'], zen_array_to_string($_SESSION['navigation']->path[$back]['get'], array('action')), $_SESSION['navigation']->path[$back]['mode']);       
      }
    }
    
    if ($link == '') {
      if (isset($_SERVER['HTTP_REFERER']) && preg_match("~^".HTTP_SERVER."~i", $_SERVER['HTTP_REFERER']) ) {
        $link= $_SERVER['HTTP_REFERER'];
      } else {
        $link = zen_href_link(FILENAME_DEFAULT);
      }
      $_SESSION['navigation'] = new navigationHistory;
    }
  
    $link = str_replace('&', '&', $link);  //-lat9- Validation issue
    if ($link_only == true) {
      return $link;
    } else {
      return '<a href="' . $link . '">';
    }
  }