You can escape the HTML, so instead of echo $item['link'];
you would write:
echo esc_html($item['link']); // This is a WP function
//or
echo htmlspecialchars($item['link']); //PHP equivalent
Also important to note your code is depreciated, fetch_rss
has been replaced by fetch_feed
.
http://codex.wordpress.org/Function_Reference/fetch_feed
ps. You can also use esc_attr
which is identical to esc_html
in this case.