snprintf conversion: y_string.c

snprintf is a tad safer than sprintf. Let's use it.