See this question, in the update to my answer I address your issue.
Specifically this bit,
I think the answer to whether to
return 404 depends on the what is the
resource that is being retrieved. Is
it a representation of a search
result, or is it a representation of a
product? To know this you really need
to look at the link relation that led
us to the URL.
If the URL is supposed to return a
Product representation then a 404
should be returned if the code does
not exist. If the URL returns a search
result then it shouldn't return a 404.
The end result is that what the URL
looks like is not the determining
factor. Having said that, it is
convention that query strings are used
to return search results so it is more
intuitive to use that style of URL
when you don't want to return 404s.