Looks like string-replace doesn't support that notation,
so both too aggressive and without sufficient control.
I've switched to replace-regexp-in-string which does
what we want.

Here's the updated patch.