Sammy.js: Whitespace + XSS fix

The usual stuff for sammy.js. The newer releases actually include automatic escaping per default. Upgrading to the latest release seems like a larger task, though, so I just backported the escaping part.

Because I manually edited the template plugin, I did not minify it. I also streamlined the whitespace/tabs use and extracted the 13 key code. Easier to review using [the ?w=1 flag](https://github.com/passy/todomvc/pull/new/sammy-fixes?w=1).

It would be great if someone could bring the app up to par with the remaining apps at some point.