OK, I've found the answer.
In addition to the 'human readable' serial/IP commands like 'Z2ON' or 'SITUNER' there are plethora of commands to simulate button pushes from the native I/R handset. The protocol document actually says this on a tab labelled 'Extension Command'. This is the something obvious that I'd failed to spot the significance of!.
However, that tab does not contain the list of IR codes you could send.

Those are contained in a Word document I found on the Denon site called:
AVR-A1H_AVC-A1H_IR_CODE_V02.doc

In that 27-page document, I found codes for SKIP PLUS and SKIP MINUS for Zone 2, which map to the >>| and |<< buttons on the remote - they are 'RCKSK0430995', and 'RCKSK0430996' respetively (page 20).
If sending them, remember to add the CR character at the end (like all commands).