feat(popupdoc): Escape unsafe variables {title, tconfirm} in popupdoc() (closes #4942)