In proper HTML, you can't use unencoded ampersands even in a URL. You need to encode them as &. See also
my rant about unencoded ampersands in Apple's (and everybody else's) affiliate program link generators and click "show details" for further explanation.
As soon as you make that change everywhere, it should pass validation.
With that said, iBooks may still not load the external content. YMMV.