All the Cypress designs have the decoupling caps on the underside of the board as it is the nearest you can get to the actual pin.
But you can insert the caps on the same side of the board, making sure they are still very close to the respective pins. We do not have a specified max distance/length for this.
Also make sure to not route these (decoupling) traces near any clock and USB signal traces. They will degrade these signals.
You can verify if your supplies are stable by checking the voltage level on each of the domains and making sure they do not exceed the specified ripple tolerance specified in the datasheet.
The tolerance for AVDD is tight (20mV), so maybe you can add this decoupling cap on the underside and the rest on the other side.