Escape HTML in vomnibar tab URLs

Fixes #1003