Fix HTML escaping in Vomnibar and HUD

* Fix #913 *(my bug)*:
Changed `innerHTML` to `innerText` for `HUD.show`. I can't find anywhere/any reason that markup would be passed to the HUD, except unintentionally by the user.

* Fix #810:
Escaped HTML in Vomnibar bookmark URLs.

* Fix #914 *(mine again, sorry)*:
Only noticed because of checking previous fix. Escaped HTML is not highlighted by `highlightTerms`, as the escaped HTML no longer matches the (unescaped) search term.
I feel more inclined to do all escaping in the `highlightTerms` function, and rename it `highlightTermsAndEscape`, but I don't want to make a code smell or upset anybody.