z_html: fix escape check of &lt; and &gt;