You make an excellent point about the dangers of string-eval. Of course you need to de-taint the module-name before you eval it. Perhaps something like the following would help to assuage your fears?

#!perl -T
use strict; use warnings; # flame-resistant

print "module: ";
chomp(my $module = <STDIN>);

if ( $module =~ /^([A-Za-z0-9_:]+)$/ )
{
    $module = $1;
}
else
{
    die "Can't use $module: hack off, buddy!";
}

eval "use $module";
print "game over ($@)" if $@;
print "all clear\n";
[download]

The verbosity certainly rivals the package-name-to-file-name twiddling that you had to do, so neither way is preferable... :)