Clean approach, and the peek4 read lines up with your byte offsets. Two pitfalls worth guarding for a touch stick inside the itch embed.
Track the touch by its identifier. If the stick reads touches[0], a second finger on a fire button can take over the stick or make it jump. Store the identifier on touchstart and only read that touch in touchmove and touchend.
Set touch-action: none on the stick element, or call preventDefault in a touchmove listener registered with passive: false. Otherwise a phone browser can scroll or zoom the itch page under the player's thumb.
For your lost focus case, listening for visibilitychange as well as blur also covers the player switching apps on a phone.