zone.lisp: Choose first matching record for preferred subnet.

The old (overly imperative) algorithm picked the last, which doesn't fit
with the fallback to the first record if none is preferred.