The problem with a simple Zener and a fuse, is the fuse has to be on the output and the Zener has to be able to blow it. The fuse needs to be 7A so it doesn't blow on repeated servo stalls, and at a 16V clamping voltage will need to pass several times the rated current to blow it fast enough to do any good. At 7A its instantaneous dissipation at its clamping voltage would be 112W. Multiply that by whatever overload factor you get from the fuse's characteristic curves to blow it quickly enough . If its under-rated for peak power, it will fail before the fuse does and there's enough energy available to blow it open rather than shorted, which is 'GAME OVER!'
Therefore you absolutely need that crowbar SCR.
The voltage reduction ratio at min. input and max. output voltages is 2.5. Therefore, ignoring losses due to less than 100% efficiency,
I
in=I
out/2.5
so the input can be fused at a substantially lower current than the output. At higher input voltages and lower output voltages it will draw less current. A 3A fuse on the input should be able to supply >6.5A at the output and will be *MUCH* easier to blow reliably with a crowbar circuit.
However IMHO a 16V crowbar threshold with a 16.8V abs max load voltage rating is unrealistic. You'll have difficulty getting a close enough tolerance Zener. Use a 15V 5% one and worst case it could be anywhere from 14.25V to 15.75V, a 1.5V range even before you add the tolerance of the SCR V
gk at its trigger point.
You've only got 2V 'headroom' from nominal to max load voltage, and you've already used up 75% of that for zener tolerance!
Personally I'd use a TL431A 1% adjustable shunt regulator and start with the crowbar circuit from its
T.I. datasheet figure 22, (page 27) modified to separate the rail being crowbarred by the SCR, from that feeding the TL431 and being monitored, by adding a PNP transistor as per figure 21, with its collector driving a SCR gate, and a gate pulldown resistor, so the TL431 can be fed from the buck converter output as its abs.max. V
gk is only 37V, less than your battery. voltage. Put a low value resistor (a few tens of ohms) between the PNP collector and the gate to limit the gate current so tripping it during testing doesn't damage the PNP or the SCR.
Test with a car bulb load and a 120V oven bulb in series with the SCR, so it can be tripped non-destructively, by cranking up the buck output till it trips, then if you are confident the SCR is beefy enough, do a final test with a real 3A fast blow fuse and no oven bulb to confirm the crowbar can clear the fuse without damaging itself.
Ash posted while I was typing this and his crowbar circuit is very close to my suggestion except for where the SCR anode connects to.
Add another TL431 Anode and Cathode in parallel to the over-voltage detection one, and feed it Ref pin from an adjustable (or carefully precalculated) potential divider including a NTC thermistor in its upper arm in contact with the buck converter heatsink and you can then trip on overheat hopefully before the buck converter blows. If you are 'gold-plating' it, use a Zener to stabilise the thermistor supply voltage so the trip point doesn't change with output voltage.