Escape everything, not just the link content

Debug output from the spec was getting interpreted as HTML tags. This fixes that. After this, the next step might be to handle ANSI escape sequences properly, or strip them out.