Replace correct ACL association

Addresses #1843 . Only the _specified_ subnet's ACL association is replaced, not the _first_ one.