Get available CIDRs from existing VPC
Don't worry about putting each stack in its own set of subnets, that's an overkill. 

Simply make the resources' Security Groups refer to other SGs in your stack templates and not to subnet CIDRs. 

What that means is for example the RDS SG sg-123456 will permit traffic from App SG sg-9876543 and not from the App subnet 10.20.30.0/24 you'll be fine from the network isolation perspective.

We usually have the VPC infrastructure shared for dev, test and feature stacks. That's perfectly fine. Moreover we also use CloudFormation Exports to simplify the templates.

Hope that helps :)