helper: fix crashing bug in token_to_ul()