hmm good point looks like a bug. We should probably have a boolean flag for UI to work around this.
I think it would work if you created the cert outside terraform and just passed ARN string in as a literal, but since the cert is created in the same template in your case, terraform technically doesn't know for sure if that value going to be empty or not, so it can't figure out whether UI submodule should be enabled or not.