Fix output.

1. Alfred requires that the resulting XML should have HTML characters
escaped.

2. `&` should be escaped just like `+` was on d05c642b61.