Thanks - I checked out those forums and found a few possible solutions I can try. It seems like Thickbox is pretty buggy in just about any version of IE, but some people have gotten it to work with modifications.
Only thing is, the version of Thickbox.js that comes with ZenPhoto appears to be partially encrypted, and says at the top that it's "Modified for use with gettext". So while I could replace it with a fresh copy of Thickbox that's not encrypted, if it has not been modified the way that ZenPhoto thickobx.js has, will that break things?
Alternatively, is it possible to get a copy of the version used in ZenPhoto without the encryption, so that I can try some of the edits to function tb_position() that were suggested in the Thickbox forums?