I'm the author of Recipe #12 in the 2014 Cookbook. I have not generally used gre over ipsec in recent years because I'm comfortable with the level of encryption security provided by current IPSEC tunneling. And thus I don't see the need to run the gre inside of this IPSEC encryption. So the basic layout presented in the book is one I've used for deploying OSPF over the internet IPSEC branch connections.
You can run GRE over IPSEC, I think you are reading the kb incorrectly. The error message about GRE coming first is a result of having the zone configuration for the GRE interface not match the IPSEC interface zone. I don't think they are suggesting running IPSEC over GRE but making the zone change to allow the GRE tunnel to come up over the IPSEC tunnel.