When a numeric character reference (&#...;) fails to parse, the catch block
restored the text as "&#" + e where e already begins with '#', producing a
doubled '#' (for example "&#foo;" became "&##foo;"). Restore the original
text as "&" + e + ";" to match the named-entity fallback and keep DeEntitize
idempotent for unparseable numeric entities.
