Double braces {{ }} output do not replace forbidden code points

I have a string with [invalid XML code point](https://www.w3.org/TR/xml/#charsets)
```js
var o = { name: "A\u0002B" }
```
And [Handlebars.js](https://handlebarsjs.com/) template: `{{name}}` which outputs the string unchanged with U+0002 character between A and B. A web browser display such HTML somehow, but HTML validation https://validator.w3.org/nu/#textarea fails with: "Error: Forbidden code point U+0002".

See also:
https://stackoverflow.com/questions/79599889/handlebars-js-double-braces-output-forbidden-code-point

Is there any way how to make double braces to sanitise such input, e.g. replace invalid code points by Unicode replace char U+FFFD ? If not, is it possible to make a runtime option for that?

Reproduce the issue with the provided JavaScript object containing U+0002 and the {{name}} template, then trace how interpolated values are emitted. Done means agreeing on the sanitisation or runtime-option behavior and verifying that forbidden XML code points are replaced with U+FFFD without changing valid content.

Written by the indexing model from the issue text.