Lock underscore version

Since it's not semver compliant.

See https://github.com/AmpersandJS/ampersand-view/issues/15