The iOS developer program agreement section 3.3.2 reads (in part) as follows:
An Application may not download or install executable code.
Interpreted code may only be used in an Application if all scripts,
code and interpreters are packaged in the Application and not
downloaded.
When the license agreement was updated in 2010, this change was covered by most major Apple news sites (since it was a relaxation of the earlier rules). For example, here.
To that end, Lua should be okay as long as all the code you run is bundled within the resources of your application and never downloaded remotely (so Apple can verify it). Of course, I am not a lawyer so my interpretation of legal documents should be taken with a suitably large pinch of salt.