It seems many projects with subrepos are structured like:

app/ <- main repo lib/ <- a subrepo

This is perhaps the most obvious way to do things, but is not really ideal. A better way is:

build/ <- main repo app/ <- subrepo lib/ <- subrepo

For starters, this does away with most of the "I didn't mean to recursively commit" issues as commits at the top-level will be much less common.

This also greatly lowers the degree of dependence between app/ and lib/, but still gives you the ability to commit and tag coherent combinations of app and lib.

A general statement of this approach is: "if a repo contains real code, it shouldn't contain subrepos."