Escapes < and > to support inner html within produced commands.

Does not escape other entities, to avoid altering the essence of a test (which
may expect á instead of &aacute;) for instance.