We now cope better with odd names

My example is a person with the name "O'Weirdy, with <b>boldness</b>".
That should render literally.  (To allow for the fact that peoples'
names can vary widely.)

Introduced Thing.unsafeDisplayName, which does no processing on the
name.  Should be used only in environments where we are confident that
higher-level code will properly escape any HTML.  This is a bit of a
hack, but good enough for now.

Fixed a bug in menus, which were breaking on strange characters.