Rugged Duino uses a 5.1V zener on each IO line.
My research on the inter nets tells me this is a bad idea. The internal protection diodes inside CPU will begin conducting before the Zener climbs up its knee to shunt off significant current.
And the resistor should be on the micro side of the zener.
But... I dunno..
Right, for starters the zener is only functional if the pins are 5V-tolerant, which it seems is not what the OP is concerned about. Clamp diodes are fine, and preferable at lower supply voltages (you can't get <5V TVS that are any better than 5V types), or you need a different technology like snapback diodes, which perform much better at low voltages.
Putting the clamp out in front of the MCU, keeps surge/fault currents away from it. A series resistor between them serves to limit peak current from the clamping voltage, which will be elevated (20-30V is a typical figure), so a modest resistance brings it into safe operating limits.
My change of plans is to use a BAT30S on every IO pin. Yes... that will be a mess. But I couldn't find any reasonably priced high count schottky arrays with low Vf.
Eh, dual duals are about the best you'll find. Not bad.
Schottky aren't great for surge, anyway; they have higher internal resistance than PN diodes. Typically, under surge conditions, the PN guard junction (a PN diode constructed in parallel with the schottky junction, typically around it to improve robustness) carries the majority of the surge current anyway, so the schottky part is just dead weight (and a lot of weight it is, BAT30 is ~14pF vs. BAV99's ~1pF).
Quad clamp arrays (and even more), typically with a TVS included, are cheap and plentiful.
Tim