And we have an encoding routine that does this. At first it was a bit of a puzzle, why isn't the encoding routine working? The answer is that we weren't calling it on links. I guess the assumption was that links couldn't legally contain markup, so there would be no reason to encode them. But here's a case, however bizarre (why put a carriage return in a link?) where the encoding is necessary. So I added it. Also added encoding for the feed-level link as well.
It takes years to shake out all the bugs in a format, no matter how simple it is. That's why once you have systems that work, you don't want to start again with something new that's exactly like what it replaced.
Note that this was neither a problem with XML or with JSON but rather with some data that pushes both formats to their limits, in an unusual way and thereby uncovered a bug in my code. So our JSON rivers got a little more solid, and that's a good thing.