I didn't like the top poster's way of completing this question. So far the best way I've found is to do:
- foo = "&".html_safe
%a(href='/posts' data-icon=foo aria-hidden='true')
I'm not fully happy with this, but think it's better for rails apps rather than turning off HTML escaping everywhere.