Add missing escaping

Adds a variety of escaping improvements (mostly to translations) to harden the theme against XSS, XSRF, and other badness.
> Have you done this since get_comments_number can be filtered?

I think we should actually change `%2$s` to `%2$d`. Personally, I'd prefer to keep the type casting either way. If nothing else, it makes the code easier to read because you know the return value of that function should be an integer.