wmaker: fix arbitrary shell command injection

Workspace background pref can be tricked to run arbitrary cmds.