Yes, escaping everything (and as close to output as possible) is a way to go. Right until the point excessive escaping is causing issues in specific circumstances.
Note that while this happens in context of attribute, esc_url() is more fitting for URLs.
Always use esc_url when sanitizing URLs (in text nodes, attribute nodes or anywhere else).