the script does
I just crawled your site with standard PHP Sitemap Generator v1.06 and all '&' signs are urlencoded to '&' correctly!
But I believe I know why you think it doesn't: perhaps you're checking your sitemap with the browser, which makes the revert operation - it decodes the URLs to show them to you. If you want to see the source
of your XML file, please save it to disk and view with some text editor/viewer, not browser.