Markup filtering at theme level (security)
Rather than remembering specific rules about which variables are safe at which point in the process I suggest you just test things out.

If you can execute Javascript by entering it as the title then you know you have a problem. I try each of these two example snippets of javascript when I want to test something:

&lt;script&gt;alert('xss');&lt;/script&gt;
&lt;img src="notfound.png" onerror="alert('xss');"&gt;


If your sanitization is working properly then you should either see the tags escaped (displayed as &gt;) or stripped (completely removed from the output).

It is also good to understand the internal workings of Drupal so that you know which functions are safe or not, but knowing how to test for XSS will serve you well in dealing with areas where you are unsure or working with something other than the API.