Sanitizer handles invalid utf-8 characters gracefully

The sanitizer would fail if an invalid utf-8 character was passed along. This PR replaces the invalid characters by a `?`, so the `sanitize!` method doesn't blow up.

//cc @libo @vkmita @ggrossman