Is there a way to execute code within a Module as a certain role, separate from running the deployment that calls that code under that role? I have a fn in a module that requires a higher permission to run, but I don’t want to grant that higher permission to the entire UserEvent script.

No. Not specifically. You could look if the current user has those permissions that are needed to complete the module script.

or encapsulate that module in a suitelet that can run with elevated permissions.

i would not expect a user event script making a call to an internal suitelet to be simple