Is my script secure to prevent email injection?
Validate, but don't change user input

Don't change the value of a user input. Either accept or reject it, but don't try to guess what might be ment. Some examples:

The name could be Søren Kierkegård, which in many evironments will become Sren Kierkegrd due to your 'sanitation'.

An email address can be much more complicated than your test suggests. How about parenthesis, exclamation or question marks? Read this for other thoughts about email validation with regular expressions.

The message still could contain 'Bcc:' or 'Cc:'. Making the expression case insensitive will lead to the next problem: The sequence "People I met in Toronto: A, B, and C." would become "People I met in Toron A, B, and C." 

Escape your output instead

Header fields are restricted to a single line (each). So is the name of a person. In these cases, all whitespaces are equivalent (at least for non-malicious input), so replacing newlines and tabs with spaces does not alter the (meaning of the) content.

$name    = isset($_POST['cf_name']) ? $_POST['cf_name'] : '';
$email   = isset($_POST['cf_email']) ? $_POST['cf_email'] : '';
$message = isset($_POST['cf_message']) ? $_POST['cf_message'] : '';

$mail_status = sendMail($name, $email, $message);

function sendMail($name, $email, $message)
{
    // Whitespace pattern, icluding different masking methods
    $whitespace = '~(&lt;CR&gt;|&lt;LF&gt;|0x0A|%0A|0x0D|%0D|\\n|\\r|\s)+~i';

    $name = trim(preg_replace($whitespace, '', $name));
    if (empty($name)) {
        return false;
    }

    $email = trim(preg_replace($whitespace, ' ', $email));
    if (empty($email)) {
        return false;
    }

    $mail_to = 'admin@mywebsite.com';
    $subject = 'New Contact for My Website from ' . $name;

    $body =  "From: $name\n";
    $body .= "E-mail: $email\n";
    $body .= "Message: $message";

    $headers =  "From: $email\r\n";
    $headers .= "Reply-To: '$email\r\n";

    return mail($mail_to, $subject, $body, $headers);
}