conflicts with default HTML filter badly

I would like to allow my visitors to post source code, highlighted with geshi filter.

Of course I also need to filter malicious HTML code, so I must enable HTML filter too.

This should not be a problem, I first use HTML filter, and then geshifilter.

Still, the result from code like:

[code lang="c"]
int main() {
}
[/code]

becomes

amp#10;int main() {amp#10;}amp#10;

where amp is a real ampersand

If the HTML filter is switched off, it geshifilter works flawless.
Using HTML filter after geshifilter is obviously wrong.
Drupal version 6.2.