Right now we're using our own built-in solution based on SSS, and we want to switch to KMS.
How far can we go? Can we use AWS' KMS for both the KEK and the DEK?
There's nothing within the PCI DSS which would prevent you from using AWS KMS for both the KEK and the DEK.
You should ensure you're generating strong keys, the KEK is equivalent strength to the DEK (e.g. both AES 256-bit), the DEK is encrypted by the KEK and you have separate key custodians for key components.