Escape `&` as `&amp;`

Previously, copying `&ampamp;` or `&amp;amp;` and pasting it into Dabblet would actually insert the text: `&amp;`. This patch fixes that.