Changed .html() to .text()

The string passed to the menu items is eventually "eval"ed by jQuery, so using .html() allows XSS to get through and get executed by the browser.