You can't protect against this. Any confirmation messages are subject to the same problem. Look up the FLP paper for proof.

This is really a user interface problem; your user needs to think of a transaction during a network outage as being in an "unknown" state rather than a "succeeded" or "failed" state.