Encryption(AES) and verification per message
Idea 1 is similar to what TLS actually does (and begs the question &quot;why aren't you using TLS?&quot;).  Modern thought is that it'd be generally better if you first encrypt, and then perform the MAC, as in:

E := AES(M)
Send IV, Encrypted HMAC(IV | Encrypted)

But no radical problem is known with your idea (unless you send M1 and M2 at different times; if you do, you open yourself up to a chosen plaintext attack -- however, that's an issue with CBC mode, not your general idea)
On the other hand, idea 2 is known to be broken; if the messages are longer than 32 bytes, then the attacker can (for example) modify one of the first bytes in the encrypted region that holds M1; on decryption, this would modify the first 32 bytes of M1, but nothing past that.  That is, the encrypted zeros would still decrypt as zero, and so the attacker has managed to modify M1 undetected.