Harden prompts against unknown input

[alistairjcbrown]

We pump cinema listings and themoviedb data into the prompt -- it's low risk, but there's still some risk. Look at security patterns to make sure we're doing evertything right