Split out filter_ui (which does not want to be updateable) from maybe_truncate (which does). Rearrange how HTML gets escaped to make sure we highlight things that need escaping.