Fix #348: reject unescaped control chars