sval: fix bug in handle_ampersand()