Pad ciphertext with arbitrary number of bits
After a bit of additional reading I realized that appending noise to the ciphertext doesn't affect decryption of the plaintext part. The solution is therefore quite simple:

Encrypt length + plaintext with AES, then pad the ciphertext with as many random bits as necessary. HMAC the result including the random bits.

To get the plaintext back, first validate the MAC, then trim the ciphertext down to the nearest AES block size. You can then decrypt the result back to length + plaintext + garbage.