Ah, I did figure out how to fix this! In the app that owns the saved search, look for the $app/metadata/local.meta file. In that file, look for the name of the saved search. There is a field called "owner" that has the old AD or LDAP userid in it. Replace that old userid with "nobody" (no quotes). This is a userid that Splunk sets aside to be able to run saved searches when there is no real userid that owns the search anymore.
Restart the search head after the change, or run $SPLUNK/bin/splunk btool fix-dangling and wait a few seconds and reload the dashboard.