fix: sanitize variable substitution pattern

replace '${foo+repl}' pattern with '${foo:+repl}' (latest supports $foo being defined but empty)