Thanks acrylian, but no, hotlinking is not an issue for me. I just want to restrict access to /albums and everything in there to zenphoto and ftp.
I am a kindergardener when it comes to both htaccess and chmod/chown, so I am not sure if my htaccess-attempt is a) well formed and b) keeps people from accessing /albums and subfolders/-files, but what I like about the solution is, that it displays the zenphoto-404-page and not some ugly »permission denied«, as does the first solution I posted.