Todo items with " & < or > were not properly rendered because they were
not escaped.

Thanks to Jacob Leemaster for the bug report.