SSL-strip is not an issue when you are using an app, it is only an issue when you are browsing the web through a browser. It works by replacing HTTPS links with HTTP links in an HTTP page. Since the URLs are usually hardcoded into an app, they can not be replaced by a MITM. So there is not the same need to worry about SSL-strip. (I guees you could get in trouble if the app follows URL:s in an API response, but I am pretty sure Google is smart enough to make sure they are to the right domain and use the right protocol.)
I have not been able to find an official statement, but I am pretty sure that the Gmail app uses TLS. Their webmail is only served over HTTPS, and other clients connecting to Gmail must use TLS. I find it hard to believe that they would make an exception for the Android app. So I would not worry about a MITM even if you're using public Wi-Fi.
Besides, I am not sure the app even uses the password - probably it uses some other kind of access token.
So how was your password stolen? I have no idea. Maybe you reused it on some other site? Maybe you entered it somewhere else? All I'm saying is that it was probably not sniffed from the Android app. Anyway, if you haven't already done it, you should change it.