$nav_id comes from outside, should be escaped.

$nav_id comes from outside, so this variable should be escaped.

Same defect found on TwentyTwelve theme. (TwentyTwelve theme is already fixed.)
https://core.trac.wordpress.org/ticket/22690