Talk to your friend. The next time he touches you if you're uncomfortable, push him away and say : " Snap out of it! I'm not your girlfriend! " If your friend and the boyfriend are really tight, a more settle approach might be better.
tell him you're going to tell her. then do it. but when the fireworks start tell them you are leaving them to work it out by themselves. it's a damned if you do,and damned if you don't situation. she will be mad if you don't tell her, and she'll be mad if you do. it is the only way to protect yourself though. because,what would she think if she found that he had been doing that and you hadn't told her? it really leaves you with that and the only other option is to tell her when you guys are alone. you know her,so it's up to you to decide. I hope everything works out the way you'd like it to.