The issue is not the ampersand in the URL. The issue, instead, is that weather.gov appears to be blocking these types of requests. They will not allow users that do not have a useragent set.
The fastest way to get around this is to set a UserAgent within PHP, which you can do by putting this code above your xml call:
ini_set('user_agent', 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0) Gecko/20100101 Firefox/9.0');
However, I would recommend using CURL instead of simplexml_load_file, as simplexml_load_file is often restricted by server configuration. If you were to do this with curl, you'd want to do something like the first answer here: SimpleXML user agent
I have tested this locally and got it working just by specifying a user agent.
EDIT: Also, welcome to SO! Be sure to vote often ;D