Fix broken XMLUtils sanitize method

Don't blindly allow code points above 0xfffd in XML docs.
Bug was due to a >= instead of a <=.