fix(html): harden variant selector escaping

Co-Authored-By: Virgil <virgil@lethean.io>

responsive.go

@@ -1,6 +1,9 @@
 package html
 
-import "strings"
+import (
+	"strconv"
+	"strings"
+)
 
 // responsive.go: Responsive wraps multiple Layout variants for breakpoint-aware rendering.
 // Example: NewResponsive().Variant("desktop", NewLayout("C").C(Raw("main"))).
@@ -36,6 +39,12 @@ func escapeCSSString(s string) string {
 		case '\f':
 			b.WriteString(`\c `)
 		default:
+			if r < 0x20 || r == 0x7f {
+				b.WriteByte('\\')
+				b.WriteString(strings.ToLower(strconv.FormatInt(int64(r), 16)))
+				b.WriteByte(' ')
+				continue
+			}
 			b.WriteRune(r)
 		}
 	}

responsive_test.go

@@ -123,6 +123,7 @@ func TestVariantSelector(t *testing.T) {
 	}{
 		{name: "plain", variant: "desktop", want: `[data-variant="desktop"]`},
 		{name: "escaped", variant: `desk"top\` + "\n" + `line`, want: `[data-variant="desk\"top\\\a line"]`},
+		{name: "control char", variant: "tab\tname", want: `[data-variant="tab\9 name"]`},
 	}
 
 	for _, tt := range tests {