& in sitemap links, are they correct?

That is correct. It is the HTML entity for an ampersand (&) and is the proper character representation of it in a properly encoded URL. Ampersands (&) and well as < and > are special characters in XML and HTML and need to be displayed using their special character entities.

Your Sitemap file must be UTF-8 encoded (you can generally do this when you save the file). As with all XML files, any data values (including URLs) must use entity escape codes for the characters.

This may help out, http://sitemaps.org/protocol.php

You can also convince yourself by checking

• this sitemaps and ampersands article
• official XML sitemaps protocol page

You can't really argue against the official xml sitemaps protocol page :)