Just make sure it is uneconomic to attack.

The Finney attack is nearly 100% successful but it costs $4 per second to pull off.  So for anything sold worth more than $20, make sure to delay it a few seconds. 

A race attack isn't guaranteed to succeed (maybe one out of 40 attempts would succeed), but it is cheap to attempt.  But if I end up with 39 frozen burritos just to get the 40th one to spit out "for free", I'm not going to try.

Now let's say there is a change machine that converts bitcoins to quarters at a laundromat, with no fee.  An attacker could sit there all day and profit from the successful attempts and break even on all the unsuccessful attempts.  So that's not a good candidate for 0/unconfirmed transactions.