Escape HTML control characters so feed is valid