Turns out there's a buried property in the Spry XML Data Set called entityEncodeStrings, which defaults to false. Turning it on solves everything. Thanks anyway.