Marionette: Escape HTML in item titles

Sorry, I forgot to mention this in #391. Here's the XSS fix for #397.