The U_NOTIFICATION_SETTINGS variable was modified in PHPBB3-14533 to direct to the correct page, but the URL contains an HTML entity for the ampersand. Normally this would be fine, but the URL gets sent to a plaintext email template, so the entity is never decoded back into an ampersand.

The only notification methods I can see that implement messenger_base are email and jabber, neither of which seem to require URLs to replace ampersands with HTML entities, so I think we can just change the entity back to an ampersand?