add late escaping to admin_table_row(), per VIP

Also escaped a $ in a string.