product ids are always prepended with a p_ when generated by the servlet so I'm not sure why the it is treating the last path element as a possible product id when p_ is missing from it.
We should be able to fix this easily enough by always treating the last path element as a category id if it isn't prepended with p_ (let's hope no one ever creates a category starting with p_). If p_ is missing and the id doesn't resolve to a category then we could allow it through as a product id.
An alternative solution could be to have two mount points for the servlet: products for products and categories for categories, that way there will never be any ambiguity.
For backwards SEO compatibility we could redirect any /products/categoryId urls to the new categories url.