1. I've got rid of "No image", and replaced with the product title (esc_attr'd)
2. Fixed. Also picked up a couple of others and done them too (Related: If we esc_url do we also need to esc_attr if it's going in a src/href ?)
3. Ack - fixed

I've trawled through and added a bunch of esc_ functions - could do with a 2nd check over although all seems to be working for me!