Nice thing about high voltage DMOS is you can afford enough voltage range to use a frickin' MOV to handle ESD/surge. (No need for leaded parts, MOVs come in small chip packages too -- the low ESL is especially good for ESD.)
If you're using a biased clamping rail, note that you need capacitors to absorb ESD. Something like a TL431 won't react nearly quick enough, and can't handle that much current anyway (~100mA; figure ca. 10A peak during an ESD pulse).
TL431 is normally rated for 1mA bias, but that's for VREF within spec. The subthreshold region is poorly documented, but it's usually the case that complete cutoff (Ik <1uA?) comes for V_VREF < 2.2V or so. Which is still a damn sight sharper than any zener diode can do.
Also, if you do opt for an "adjustable shunt" like this, using a high-ohms divider to VREF (assuming IREF is low enough -- TL431 isn't, but one of the low current variants may be, or you can use a CMOS op-amp against a micropower reference to much the same effect), consider putting a capacitor in parallel with the top resistor so that transient changes in output are coupled quickly into REF. Not much should be needed, 1nF would even be a lot.
Also consider using higher voltage zeners (>= 5V) to clamp the brunt of it, then add a series resistor between zener and ADC to limit injected current. A shunt could be used to absorb excess VCC rise, or you can just kind of let it happen and see how bad it is. Most 3.6V (abs. max.) devices break down in the 4.2V range, which may not necessarily be harmful to them, but may disrupt internal state.
I once had swapped out a 3.3V LDO for 5V, which was applied to a PIC24E; it simmered in the 4.2-4.4V range with something like 100 or 200mA flowing. It kinda sorta worked, but it wouldn't always take programming, and the USB device was cacked. Presumably the analog bits (12MHz PLL?) weren't behaving under the... "sweaty" conditions, shall we say. Put in the correct 3.3V LDO and all was fine (no apparent damage to the chip).
Tim