Here's a short answer solution that should solve your problem, but it results in two separate object-graphs as defined by A:
Y and Z should probably be private modules and they should only expose the things that are being used. Being that they are third party, then I strongly recommend creating a Y' and a Z' that are PrivateModules that install Y and Z respectively and expose only the pieces that you need available in X (or that you want X to expose).
Here's my opinion:
I just recently had to traverse through some code that uses this pattern and I have to say that I hate it. Guice is really good at helping you breakdown your problem space to avoid worrying about dependencies. And here you are, worrying about your dependencies ;) (and it's not even your fault!). I've always preferred to separate my modules and combine them only at one place; the injector creation site. It's nice to free some of the responsibilities and give them to guice. If there are any missing dependencies (oops I forgot to include module 'A') you should find out immediately at runtime (there are circumstances when you won't, but not everyone deals with child injectors and the like). Guice's philosophy is fail fast whenever possible. I really like being able to remove a module and swap it with a completely different component implementation; which is what your intuition is telling you anyways!
Now if someone wanted to somehow represent module dependencies, I would probably recommend to do it by exposing the list of module classes that are dependencies and then let when about to create the guice injector make sure that the dependencies are covered. Maybe by just taking the modules, construct a set of dependent module classes and then make sure each dependencies is in the original module list. Or something like that. Realistically, anything is better than installing a dependency like that ;).
Good luck,
Nate