Escape < in url/title to prevent injecting HTML formatting into extension

This would be a potential XSS in older Chrome extensions, now it can only be an annoyance.