Why not renumber the vendors to remove the illegal characters?

That was my fallback plan, but I was hoping there might be another way (only because I'll also need to attach some validation scripts to prevent the characters from being used in vendor numbers created in the future).

Or you could modify the vendor maintenance panel with wording (Do NOT use these characters when creating the vendor number).  Use red font and bold.  Might work.