fixed XSS vuln in searchbox

Fixes issue described here:

https://github.com/tripit/slate/issues/112
Hmmm...maybe is there any way we could use jQuery's `.text()` function instead of rolling our own escaping? Like, perhaps use `.html()` to create an empty `<li>` in searchResults, and then select it and fill it with `.text()`? If you're busy or don't want to do this, feel free to LMK and I'd be glad to change it myself.