Sanitize HTML in html_select_options

\cc @karlitschek