Have had another thought!
What if I put in a bypass valve (not sure about symbol!), as below:
This way, when the tank water gets too hot, the TMV shuts down the hot port, but cannot draw cold from the cold port, so the pump drives water through the bypass valve and circulates that...