Reject signed hex digits in XML-ID _xHH_ escapes

Found while testing crates/doc/src/xml_id.rs:80 (escaped)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

crates/doc/src/xml_id.rs

@@ -73,7 +73,7 @@ fn escaped(s: &str) -> Option<(char, usize)> {
     let body = s.strip_prefix("_x")?;
     let end = body.find('_')?;
     let hex = body.get(..end)?;
-    if hex.is_empty() || hex.len() > 6 {
+    if hex.is_empty() || hex.len() > 6 || !hex.bytes().all(|b| b.is_ascii_hexdigit()) {
         return None;
     }
     let c = char::from_u32(u32::from_str_radix(hex, 16).ok()?)?;
@@ -113,6 +113,12 @@ mod tests {
         assert!(!is_valid("My Rect") && !is_valid("1abc") && !is_valid(""));
     }
 
+    #[test]
+    fn sign_is_not_a_hex_digit_in_escapes() {
+        assert_eq!(to_object_name("a_x+41_b"), "a x+41 b");
+        assert_eq!(to_object_name("a_x-41_b"), "a x-41 b");
+    }
+
     #[test]
     fn round_trip_names_that_cannot_start_an_xml_name() {
         for name in ["-abc", ".5 mm", "²x", "Ⅷ", "", "1abc", "Layer 1", " lead", "_a", ":a", "#"] {