You don't get lookbehind in JavaScript regular expressions. You do get lookahead, but it is unreliable in IE, so best avoided unless you really know what you're doing.
[^&(?!amp;)]+&
yeah, this doesn't really make any sense. You can't use lookahead in a [] character group: what you're saying here is match characters that aren't &, (, ?, ! , a, m, p, ;, or ).
However you should not see & anyway: you should be working on a plain, unencoded query string, eg. as fetched from location.search. (If you are hacking at HTML markup in a string with regex you've got much, much bigger problems.)
If you are getting the query string from location.search, you'll have a ? on the front if there's any query. So you can match the beginning with either & or ?, and do your regex match on:
location.search.replace(
/([?&;]category=)[^&;]+/,
'$1'+encodeURIComponent(sNewValue)
);
note I have also included ; as a possible separator as per HTML4 section B.2.2, and used encodeURIComponent so that invalid characters like spaces and special characters like & itself get properly URL-encoded. Also the character $, which otherwise has special meaning in a regexp replacement string.
This is still quite messy, and doesn't cope with URL-encoded parameter names (ie c%61tegory is a valid alternative way of saying category) or multiple parameters with the same name. If you want to be more robust about it you could dump the regexps and do full query string parsing/reconstruction. See the functions from this answer and do:
var lookup= queryToLookup(location.search);
lookup['category']= ['New value'];
var query= lookupToQuery(lookup);