nat: avoid creating negative zero checksum