[misc] html escape the query string before appending it to menu urls

otherwise the '&' is not converted to '&amp;', making validators unhappy