Manage main menu in module
You can stop roles from editing menus via the permissions page. That should lock that down. 

Then to manage the menus on all your sites you could use Menu Export/Import module (https://drupal.org/project/menu_import), which plays nicely with Drush to allow you to export/import entire menus. You could maintain your "master" menu in a text file in json format and then periodically push it out to all sites at once using Drush aliases or a simple shell script. Because Drush uses uid 1 I think you should be able to do whatever you need regardless of how you set your roles' permissions via the UI.