Decode our own runes when parsing queries.

In the process, fix a panic running off the end of the string.