If you want to validate two separate objects and avoid duplicating code, then I think you may be in for an answer you won't want to hear.
The only exception I can think of is to take the returned view model (unvalidated) and populate your models as you would if you were to perform the database action, then do the validation check there. If there are errors, bring those back to the ModelState dictionary and return the view to the browser with errors. This approach has the big side effect that you'd lose the client-side integration, or at best - it'd involve a lot of AJAX calls to the server side.
Personally, I'd accept defeat and accept that you're going to have duplication of effort and just ensure that as much of your code is re-usable (e.g. as Data Annotation attributes that can be placed on both your view models and business models.
However, with the business logic, if you're concerned that the data may get polluted by inconcistent checks by alternative interfaces (or your forgetfulness), then duplicate some of the methods into the business logic or into the model metadata too.