I always thought that, even if there is server-side protection for it already, the final "click this button to pay" button should get disabled when you click it the first time, preferably with a processing icon or the like. That way you provide a visual clue that something is happening if they are on a slow connection.
The server is handling 100 transactions a second or more. All through SSH sessions, or worse yet a proprietary protocol. Front end terminals are usually connected to a server in another location over VPN (or worse yet, a WAN link with an open port at the server side) and this server may be across the country. In almost all of the Point Of Sale software I've seen error checking is done locally and there is next to fuck all of that happening anyway as the goal of POS systems is to move as fast as possible. The customer hates waiting for the cash register to do its job properly.